What happened
Symantec Threat Hunter found that newer versions of the Aoki (Aokigahara) infostealer now harvest credential and session files for AI coding assistants — .claude.json, Claude desktop cookies, ChatGPT cookies, Codex config.toml/.env, and tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, plus AWS credentials. Earlier samples did not target AI files, so this is a recent capability addition.
Why it matters
AI coding assistants hold long-lived tokens that can be replayed under a developer's identity and quota, reaching connected repos, cloud services and CI/CD pipelines, and bypassing safeguards that assume requests come from a trusted user. Treating local agent config/session data (and the local Cursor state DB that caches chat/code) as sensitive is now a real requirement, because infostealers are actively shipping rules to steal it.
Attack vector
Infostealer on the developer's host exfiltrates local AI assistant credential/token/session files to its C2 (/gate endpoint)
Affected systems
AI coding assistant credential/session files on infected developer machines (Claude, Codex, ChatGPT, Cursor, Codeium, Gemini, Copilot, JetBrains, Kiro, AWS)
Mitigation
Revoke active AI sessions and rotate exposed API keys from a clean device; treat AI config/session files as secrets; monitor AI tool folders and use short-lived, least-privilege tokens