Aoki infostealer now goes after Claude, Codex, Cursor and Copilot credentials

Symantec's Threat Hunter Team reported on 15 October 2026 that recent versions of the Aoki infostealer (also called Aokigahara) harvest credential and session files for AI coding assistants. Symantec names no operating system, but several of the stealer's other targets are Windows-only, so developers who use these tools on Windows machines look most exposed; macOS and Linux are not confirmed either way. Symantec says the stolen keys can be resold or used to run up usage on the victim's account, a practice called LLMjacking.

What Symantec reported

Aoki is a relatively new stealer, first seen earlier in 2026. Older samples did not look for AI files, so the capability was added recently. Symantec's key findings name Claude, OpenAI's Codex, Cursor, Codeium and Gemini. For the newest version it lists the following targets:

• Claude: .claude.json and Claude desktop cookies.
• ChatGPT: cookies.
• Codex: the config.toml and .env files.
• Tokens: GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, plus Amazon Web Services (AWS) credentials.

Symantec gives no file paths for the token targets. It says the malware took credential, token and session files rather than source code, with one exception: Cursor's local state database, which can cache chat context and code snippets.

Symantec says such keys and tokens let an attacker act under a legitimate developer's identity and API quota. They can also expose connected repositories, cloud services and CI/CD pipelines, and may bypass safeguards that assume requests come from a trusted user.

The AI targets sit beside the usual haul: dozens of browsers, crypto wallets, password managers, Discord and Telegram, gaming, VPN and FTP clients. Symantec reads the crypto focus as a financial motive.

What Symantec does not say

• Distribution: the report does not say how Aoki reaches victims.
• Platform: it names no operating system. Other listed targets (Outlook passwords from the registry, WinSCP, FlashFXP, SmartFTP, Edge WebView2) are Windows-only, so Windows is the likely platform. macOS and Linux are not confirmed either way.
• Actor: Symantec does not know who is behind it and sees no links to any existing malware family. ThreatFrontier does not attribute it.
• Scale: the report gives no victim count or number of stolen keys.

How it exfiltrates

There is no backdoor command list. Aoki collects whatever data is available and posts it to its command-and-control (C&C) server on a /gate endpoint. Newer samples mostly use one domain, and two use their own. Symantec lists dobeqnesmot[.]cc, hjazfioe[.]surf and neihite[.]cc. The listed C&C URLs use HTTPS; older samples used an IP address and port 8080 over unencrypted HTTP. Symantec detects the family as Infostealer.Aoki; the 17 file hashes are in the report.

Infosecurity Magazine's coverage matches the report, though it leaves out Codeium.

What Symantec says Aoki takes, per AI tool; all of it goes to the C&C /gate endpoint.

What defenders should do

Symantec's only protection statement is that its endpoint products detect and block files it has identified as malicious. The advice below is ThreatFrontier inference from vendor documentation, not Symantec guidance.

1. Know where the secrets sit. The .claude.json file Symantec names is, per Claude Code's settings documentation, where Claude Code holds your sign-in session, MCP server configurations and per-project state. Per the MCP documentation, local- and user-scope MCP servers are stored there, including any Authorization: Bearer tokens added with --header. Claude Code's documentation says it stores credentials in the macOS Keychain, or in ~/.claude/.credentials.json on Linux (and as a macOS fallback) and %USERPROFILE%\.claude\.credentials.json on Windows, where it is a plain file with no Keychain. Codex's documentation says ~/.codex/auth.json holds access tokens and should be treated like a password, unless the OS credential store is used. Symantec names different files (.claude.json, desktop cookies, config.toml, .env), so check all of them. Also check shell profiles and .env files holding ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN (a one-year token from claude setup-token) and cloud keys.
2. Rotate after any infostealer hit. If a machine is suspected, treat every AI-tool login as exposed: sign out and back in, revoke and reissue API keys, replace long-lived OAuth tokens, rotate tokens for any MCP servers configured in .claude.json, rotate AWS keys, and check provider usage for spend you did not make.
3. Prefer stores that are harder to read. Set Codex to the keyring credential store rather than file. Use short-lived or helper-issued credentials (for example Claude Code's apiKeyHelper) over static keys in .env.
4. Limit the blast radius. Give keys spend caps and narrow scopes, keep AWS and repository credentials out of developer .env files, and alert on unusual API usage.
5. Block the C&C. Add the three domains to DNS and proxy blocklists.

Related coverage: stolen ChatGPT logins at 358 of 482 big companies and CARBONATO's hunt for AI API keys on exposed Docker hosts, and the dispute over Copilot CLI secret theft.

Sources

• Symantec: Aoki: Infostealer Targets AI Coding Assistant Credentials
• Infosecurity Magazine: New Aoki Infostealer Targets AI Coding Assistant Credentials
• Claude Code authentication docs
• Claude Code settings docs
• Claude Code MCP docs
• Codex authentication docs