Aokigahara | Aoki | Information Stealer | AI Developer Tools | Credential Access | Windows
Source Material: Check Point Research; Symantec Threat Hunter Team | Technology: Windows endpoints, AI coding assistants, developer and cloud credentials | Targeting: Agnostic, Developer or AI-tool usage
Executive Summary
Adversary Tactics and Intelligence is tracking an active campaign involving Aokigahara (also known as Aoki), a modular Windows information stealer observed in the wild. This advisory is issued due to a significant evolution in infostealer TTPs: recent variants feature newly added, purpose-built collection routines specifically targeting local AI coding assistants and developer tool credentials. This capability expansion marks a shift in commodity malware design, treating local AI agent state stores as high-value credential targets alongside traditional browser cookies and cryptocurrency wallets.
The malware’s dedicated routines target authentication files, session tokens, local application databases, Git credentials, SSH keys, and cloud environment configurations (AWS, Azure, and Google Cloud). Reported targets include Claude Code and Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, JetBrains AI Assistant, Amazon Q, Kiro, and Codeium. Successful theft enables cross-boundary exposure, allowing adversaries to pivot from a single compromised developer workstation to private source repositories, cloud deployment pipelines, and enterprise infrastructure.
Organizations should treat local AI-agent state files and configuration stores as sensitive credential material. Security teams should prioritize developer workstations for endpoint monitoring, revoke and rotate exposed credentials from a clean system, and hunt for Aokigahara command-and-control indicators (including /gate/handshake, /gate/chunk, and /gate/complete traffic). At the time of publication, available reporting has not confirmed the initial access vector or operator identity. While the exact delivery vector for Aokigahara remains unconfirmed, malware targeting developer workstations commonly relies on malicious search advertisements for popular software tools, trojanized npm/PyPI packages, cracked software installers, and phishing campaigns distributing rogue ISO or MSI packages.
Threat Overview and Strategic Impact
Aokigahara is a modular Windows infostealer first observed and documented in 2026. Researchers have identified possible lineage with malware previously called Kamidere or Stygian; no public attribution to a named intrusion set or operator has been established. The analyzed malware collects system data, screenshots, clipboard contents, browser credentials and sessions, cryptocurrency wallets, password-manager data, VPN and FTP configurations, messaging tokens, and other local artifacts. It encrypts ZIP archives with AES-GCM after an X25519 key exchange and uploads data in labeled chunks to a command-and-control server.
The noteworthy change is not the first targeting of developers, CI/CD systems, or AI credentials. Existing security research has already documented Amatera, Remus, and Djinn collecting local AI-agent data, while previously identified Warden stealing AI-agent and developer credentials. Aokigahara is significant because newer samples add purpose-built collection routines and a broad, product-specific path list directly to the stealer. Independent threat analysis confirmed that earlier Aoki samples lacked AI collection, confirming a recent family-level capability expansion.
By adding standardized file paths for popular AI tools directly to its collection routines, Aokigahara reflects a shift in how commodity stealers treat developer hosts. Since local AI assistants frequently store session state and tokens in predictable, unencrypted directories, harvesting them requires no zero-day exploit, only standard user-level execution. This makes developer workstations an attractive pivot point for gaining indirect access to connected cloud environments and source repositories. Although Aokigahara’s exact delivery chain remains unconfirmed, similar developer-focused infostealer campaigns typically spread through malicious search ads, trojanized open-source packages (such as npm or PyPI), cracked developer software, and phishing lures carrying malicious ISO or MSI files.
Security Hardening and Recommendations
If Aokigahara is suspected, isolate the endpoint and preserve evidence. From a known-clean system, revoke active AI-tool sessions and rotate AI provider keys, Git and source-control tokens, SSH keys, cloud credentials, browser sessions, password-manager credentials, and any secrets stored in local configuration or prompt history. Review provider, repository, cloud, and CI/CD audit logs for activity after the earliest suspected compromise; rebuild the host when integrity cannot be established.
Proactively inventory approved AI coding tools and their local data stores. Use short-lived, least-privilege tokens; SSO and conditional access; managed secret stores; separate identities for development and production; and controls that prevent production secrets from residing on developer workstations. Enforce EDR coverage and application control, restrict untrusted installers and scripts, segment developer endpoints from production administration paths, and validate the published indicators before blocking because infrastructure may change or be shared.
Detection Strategy
Our MDR detection platform continuously ingests and correlates endpoint, network, and identity telemetry to identify Aokigahara activity across monitored environments.
At the endpoint layer, our platform triggers high-fidelity alerts for risky process execution and access to sensitive browser data. At the network layer, our automated analytics inspect egress traffic for outbound C2 communication and flag HTTP POST exfiltration to hardcoded IP addresses or known threat domains, as well as suspicious POST requests, such as those to `/gate/handshake`, `/gate/chunk`, and `/gate/complete` containing the `Microsoft-CryptoAPI/10.0` user agent.
At the correlation layer, our SOC analytics track risk object transitions and trigger elevated priority alerts when multiple ATT&CK tactics are observed from a single host. Analysts investigate and correlate these endpoint and network detections with SaaS, cloud, Git, and CI/CD audit logs to identify follow-on token misuse, suspicious source IP logins, or unauthorized repository access.
How Deepwatch Protects Our Customers
Deepwatch experts continuously correlate available EDR, DNS, proxy, firewall, identity, cloud, and source-control signals associated with infostealer activity and investigate accordingly. The ATI team is analyzing available indicators to feed Dynamic Risk Scoring (DRS) and SOC alerting. Our Detection Engineers monitor the threat landscape and evaluate existing detections and/or develop new detections as appropriate.
Relevant Detections
Please visit the Guardian Platform to access the relevant detections for this activity and ask NEXA Detection Advisor for a breakdown of which detections are enabled in your environment.
Threat Hunting Leads
- Search EDR file events for processes reading .claude, .codex, .gemini, .copilot, Cursor/Windsurf state.vscdb, Amazon Q, Kiro, .aws, .ssh, and .git-credentials in a short interval.
- Hunt proxy, firewall, and EDR network telemetry for the published domains/IP and the /gate/handshake, /gate/chunk, and /gate/complete sequence.
- Look for Microsoft-CryptoAPI/10.0 with Aokigahara X-* headers when HTTP metadata is visible; do not rely on User-Agent alone.
- Correlate any endpoint match with AI, Git, cloud, and CI/CD token use from new locations, new devices, or unusual automation.
Technical Artifacts
Please visit the Guardian Platform to access available technical artifacts for this report.
Threat Object Mapping
Intrusion Set:
- Unknown / unattributed.
Attack Pattern (MITRE ATT&CK/MITRE ATLAS):
| Tactic | Technique | Technique ID | Associated Threat Activity |
| Credential Access | Unsecured Credentials: Credentials In Files | T1552.001 | Reads AI-tool tokens, Git credentials, SSH keys, and cloud configuration files. |
| Credential Access | Credentials from Password Stores | T1555 | Queries credential stores and collects browser/password-manager data. |
| Exfiltration | Exfiltration Over C2 Channel | T1041 | Sends AES-GCM-encrypted ZIP chunks to /gate/chunk. |
Vulnerabilities:
- None identified. Reported activity relies on malware execution and access to locally stored data, not exploitation of a disclosed AI-tool vulnerability.
Malware/Tool:
- Aokigahara (Aoki); possible earlier family names Kamidere or Stygian.
Additional Sources
- Check Point Research – Infostealer riding the AI Train
- Symantec Threat Hunter Team – Aoki: Infostealer Targets AI Coding Assistant Credentials
- Gen Digital – Infostealers Have Found a New Target: Your AI Agent
- Hudson Rock – Infostealers Are Actively Hunting AI Agents and Developer Keys
- Hive Pro – Aoki Infostealer Expands Its Haul to AI Assistants
Share