Aokigahara Malware Expands Credential Theft Tactics: Targeting AI Coding Assistants and Developer Workstations
Recent cybersecurity reports have revealed a new infostealer malware, named Aokigahara, which is innovatively targeting a range of AI coding assistants, developer workstations, and cloud credentials. This emergence marks a significant shift in the malicious landscape, as the threat extends beyond traditional targets like web browsers and cryptocurrency wallets, aiming directly at the tools developers use daily.
The malware’s targets are numerous and varied, affecting well-known applications such as Claude Code and Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and JetBrains AI Assistant. By focusing specifically on these AI-driven applications, Aokigahara seeks to tap into the wealth of sensitive information that developers and organizations store within these platforms.
Importantly, the malware does not exploit any explicit vulnerabilities in these applications. Instead, it operates using a more insidious method: it scans local application storage for files that may hold valuable credentials and configuration data. Not all targeted configuration files guarantee the presence of useful authentication secrets, but the sheer volume of potential targets increases the likelihood of a successful breach.
Central to Aokigahara’s infection capabilities is a dedicated handler that collects a variety of sensitive information. It specifically targets authentication and configuration files pertinent to Codex, gathers Claude credentials, and accesses state databases from Cursor and Windsurf. The malware’s reach also extends to the storage used by GitHub Copilot, revealing a sophisticated approach to data collection. Furthermore, the malware’s collection scope encompasses a broader range of resources, including Amazon Q, Kiro, AWS credentials, and AWS Single Sign-On caches, actively querying Windows Credential Manager to enhance its collection beyond conventional files.
The implications of Aokigahara’s operations are profound. If attackers successfully obtain usable tokens, they could gain access to compromised AI accounts, enabling them to consume paid services at the expense of the legitimate user or expose sensitive conversations and developmental information. Such access could lead to a range of malpractices, including the potential resale of compromised credentials on various dark web marketplaces.
However, an analysis by Check Point does not definitively clarify how the operators behind Aokigahara monetize the stolen data. Furthermore, it has not been confirmed that every session collected remains valid or usable, leaving some uncertainty about the full scope of the malware’s impact.
Additional research from Symantec’s Threat Hunter Team has closely monitored the Aokigahara malware, which is also referred to as Aoki. Their findings highlight that the collection of AI credentials was a feature introduced in newer releases, indicating that Aokigahara is part of an evolving threat landscape rather than an entirely distinct malware family.
Detailed documentation from Check Point Research has mapped the malware’s activities in the wild. Notably, the researchers have identified specialized routines responsible for gathering authentication files, session data, and configuration documentation from widely employed AI applications. Some previously circulated versions of the malware operated under the aliases Kamidere or Stygian, showcasing its adaptability over time.
The malware features a distinctive ide handler that specifically targets code editors and development environments, utilizing platforms like Visual Studio Code, Cursor, Windsurf, and JetBrains products. The scope of its intention is alarming as it seeks out Git credential files, files stored under .ssh that may contain private keys, and configuration files associated with AWS, Azure, and Google Cloud.
This intensified focus on developer resources could lead to a significant wave of exposure, potentially endangering not just individual AI accounts but also broader access to repositories, cloud resources, and integrated development services. The real-world impact of these breaches will heavily depend on the validity of the acquired credentials, the associated permissions, and whether these files truly contain exploitable secrets.
Traditional strategies commonly associated with infostealers such as Aokigahara persist, showcasing a wide-ranging capability that includes the theft of browser passwords and cookies, screenshot captures, clipboard data collection, as well as cryptocurrency wallet extraction.
The malware also contains a specific component designed for clipboard manipulation, although the particular wallet formats it targets have yet to be confirmed. Notably, the malware encrypts its configurations within the .stgcfg section and employs AES-256-CBC encryption for decryption. Configuration fields dictate command-and-control infrastructures, servers, public keys, module selections, and settings for certificate pinning.
The data exfiltration process involves several stages, utilizing pathways like /gate/handshake, /gate/chunk, and /gate/complete. In this process, an X25519 exchange is responsible for establishing shared key material, while SHA-256 is applied to derive the key used to encrypt collected ZIP archives through AES-256-GCM encryption.
Furthermore, the malware maintains clear upload headers that identify collection modules and the sequence of data chunks. While a completion message signifies the conclusion of the upload phase, it does not provide assurance that every transfer was successful.
To counter automated security analysis, Aokigahara incorporates optional anti-analysis checks that evaluate indicators from debuggers, virtualization artifacts, hardware resources, and even process counts. These checks create a complex environment that complicates automated traceability and analysis efforts.
The latest samples of this malware communicate via the Microsoft-CryptoAPI/10.0 User-Agent, shedding light on the ongoing development and configuration refinement of Aokigahara as it continues to evolve.
Indicators of Compromise (IOCs)
Cybersecurity experts have provided a list of SHA1 hashes associated with the Aokigahara malware, emphasizing the need for vigilance in monitoring these signatures:
007137599bc4d69ee952a5228b5fcb2c3b9a95a700d52c7e759d878f0d8a117502f6d854af13f00704eddccb79db41e03a4ee8542e8a33d7f1d9fe18057a2d1dedeb93b7765c455a9e0c469e7cbe4843079ddf5cc7d6ca2e02f860f87d4d18c83db9d3310b74ce90a39278fb97fe94f6306af71cbe6795030c46ac5555cf8f305c1345a21d0802c52bf52cd8
Conclusion
In summary, Aokigahara represents a troubling evolution in infostealer malware, actively targeting the resources that many developers rely upon. With its sophisticated methods for credential theft and its ability to adapt to new threats, Aokigahara underscores the need for heightened vigilance and robust security measures within the tech community. Organizations and individual developers alike must remain aware of the risks posed by such malicious software to safeguard their credentials and sensitive information against emerging threats.