A New Infostealer Now Raids Developers' Laptops for Their Claude and Codex Keys, Not Just Crypto Wallets

Criminals have decided that the key to your AI coding assistant is worth about as much as your credit card. Recent versions of the Aoki infostealer now hunt for the credential and session files of tools like Claude, OpenAI's Codex, Cursor and Gemini, grabbing them alongside the browser passwords and crypto wallets that infostealers have always gone after, Symantec's Threat Hunter Team reported.

The shift matters because a stolen AI key pays twice. "Like card data, a stolen AI key can be cashed in directly, either through resale or by running up usage on the victim's account, a practice sometimes called LLMjacking," the researchers wrote. "Unlike card data, it can also give an attacker a route into the developer's wider environment."

A young malware learning new tricks

Aoki, also called Aokigahara, is relatively new. It first appeared earlier in 2026, and older samples did not look for AI files at all. The feature was added recently and appears to be expanding. Symantec called it "a highly capable and multi-functional infostealer whose capabilities still appear to be in active development."

The newest version goes after .claude.json, Claude desktop cookies, ChatGPT cookies, and the Codex config.toml and .env files. It also takes tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, plus AWS credentials.

It is after credentials, tokens and session files, not source code. The one exception is Cursor's local state database, which can cache chat context and code snippets, so a developer's conversations with the tool may leave with it.

The AI haul sits on top of a very wide net. The latest sample also raids about 50 browsers, cryptocurrency wallet extensions and desktop wallets, password managers including Bitwarden and 1Password, Discord and Telegram, Outlook and Thunderbird, and VPN and FTP clients, according to The Injection.

Grab everything, send it home

Aoki has no backdoor command list. It collects whatever it can find and posts it to its command and control server through a /gate endpoint over HTTPS. Most newer samples used one domain and two used another, while older ones talked to an IP address on port 8080 over plain HTTP. Symantec published 17 file hashes and three C2 addresses and detects the family as Infostealer.Aoki.

Why a coding key is so attractive comes down to identity. API keys and OAuth or session tokens let an attacker act as a legitimate developer, on that developer's quota, possibly slipping past safeguards that assume requests come from a trusted user. From there, connected repositories, cloud services and CI/CD pipelines can come into reach.

The bill alone can hurt. Earlier this year AI evaluation nonprofit METR lost about $600,000 in donated credits after attackers lifted a single model provider key from a researcher's exposed dashboard.

What is still unknown

Plenty. Symantec does not know who runs Aoki and found no links to existing malware families. The crypto-heavy target list points to financially motivated attackers, but that is the researchers' inference. There is no breach at Anthropic, OpenAI, Cursor or any other AI provider here; the exposure comes from an infected machine. Symantec has published no victim count.

For anyone whose machine may have run Aoki, the cleanup is broad. Rotate the API keys and tokens of every AI assistant used on it, revoke its browser and desktop sessions, revoke AWS credentials and GitHub tokens, and check endpoints against Symantec's published hashes and C2 addresses.

Researchers said Aoki's development suggests AI credentials now rank alongside payment cards and crypto wallets in criminal eyes. The developer laptop, with its keys to models, code and cloud, has become a target in its own right.

Some offers on this page may be paid placements or contain affiliate links.