What happened
Check Point Research and Symantec documented an in-the-wild infostealer (tracked as Aokigahara / Aoki, earlier Kamidere/Stygian) with dedicated handlers that harvest authentication tokens, session data, and config files from AI coding tools — Claude Code/Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and JetBrains AI Assistant. A separate IDE handler also collects Git credentials, SSH private keys, and AWS/Azure/GCP credential and config files, plus Windows Credential Manager. Stolen material is zip-encrypted (AES-256-GCM) and exfiltrated to attacker C2.
Why it matters
This is the AI-ecosystem credential surface being harvested at scale: a single compromised developer workstation yields AI provider sessions, source code, and months of proprietary AI conversation history, alongside cloud root-type credentials. The asset is the developer/AI keyring, and it monetizes via resold AI subscriptions and cloud pivot. It targets AI developer tooling directly and is in the wild now — no CVE required.
Attack vector
Malicious download / trojanized package / phishing lands on a developer endpoint; the stealer scans local AI-tool and cloud credential storage and exfiltrates sessions and keys.
Affected systems
AI coding assistants and developer workstations (Claude Code/Desktop, Codex, Cursor, Windsurf, Copilot, Gemini CLI, JetBrains AI); no vulnerable product version — malware searches local app storage.
Mitigation
Treat AI-tool session tokens as enterprise secrets; revoke and rotate AI, cloud, Git and SSH credentials after any suspected Windows infection; apply EDR/email controls and block the C2 sinks and SHA1 IOCs from the Check Point report.