Saturday, 31 October 2026Global tech news & guides — what changed, and what it means for you.
AuTechWire
Original editorial illustration of a dark developer workstation at night: a laptop screen glowing with a generic chat interface, shadowy thread-like tendrils reaching from the screen toward scattered key and token shapes on the desk, amber and teal grade

Aokigahara Malware Targets ChatGPT, Claude and Cursor Credentials

by

Aokigahara Malware Targets ChatGPT, Claude and Cursor Credentials

In brief

  • Check Point’s Aokigahara infostealer harvests AI tool logins and cloud keys from infected PCs. Not a breach of ChatGPT or Claude — what to revoke first.
  • This is not a breach of OpenAI, Anthropic or any other AI provider. The malware collects files stored on an infected computer. If those files hold a valid session token, an attacker can use the account without knowing the password.
  • A dedicated collection module, named “aisessions,” targets credential files, configuration files and session data for each tool — for example, credential files and desktop folders for Claude, authentication and environment files for Codex, local storage databases for Cursor, and application cache for ChatGPT Desktop.
  • The same malware also sweeps up the rest of a developer’s identity: Git credentials, SSH files, AWS, Azure and Google Cloud configuration, browser cookies and passwords, messaging and email apps, VPN apps, wallet data, screenshots and clipboard contents.
  • Check Point has not confirmed how Aokigahara’s operators make money from what they steal, and has not attributed the malware to any threat group. The risk described below is what valid stolen sessions could enable, not confirmed activity by these operators.

The shift: your AI tools are now part of your attack surface

For years, infostealers have gone after the same things: browser passwords, cookies, crypto wallets, and whatever else a computer holds. Aokigahara is notable because it adds a new category to that list, explicitly. Its “aisessions” module exists for one job: find the files AI tools leave behind that prove who you are to those services, and take them.

That matters because of how developers actually work now. ChatGPT, Claude, Cursor and their peers do not sit apart from the rest of a developer’s environment. They sit next to source code, next to cloud consoles, next to repositories and deployment pipelines. A stolen browser cookie might get an attacker into a website. A stolen developer session can get them into the account that writes code, the API key that bills by usage, and the cloud configuration that provisions infrastructure. Check Point’s point, in its own framing, is that AI credentials have become part of the wider developer and identity attack surface — not a side curiosity, but a credential class worth protecting like any other.

There is an earlier chapter to this story, and it makes the trend harder to dismiss as a one-off. Symantec’s Threat Hunter team had already documented the same malware family, under the name Aoki, expanding into AI-tool credentials before Check Point’s report. Earlier Aoki samples did not search for AI-related files at all; the newer samples do. The files Symantec named match Check Point’s account closely: a .claude.json file, Claude desktop cookies, ChatGPT cookies, Codex config.toml and .env files, and Cursor’s local state database, which may hold chat context and code snippets. Two independent research teams, looking at different samples, found the same direction of travel. That is what turns a single report into a trend worth acting on.

What Aokigahara actually collects

It helps to be precise about what “steals your AI login” means here, because the mechanism decides the fix. Aokigahara does not break into ChatGPT’s or Claude’s servers, and it does not guess passwords. It reads the local machine.

For Claude, the collection targets credential files and desktop application folders. For Codex, it targets authentication, configuration and environment files. For Cursor, it targets local storage databases. For ChatGPT Desktop, it searches the application cache. The module also queries Windows Credential Manager for stored credential information. Not every targeted file necessarily holds an active secret — some may hold settings or inactive data — but the ones that do hold a live session token are the prize, because a session token is already authenticated. There is no password prompt to defeat and no multi-factor challenge to pass if the token is simply replayed.

A second module, called “ide,” widens the haul beyond AI tools to the developer toolchain itself: Git credentials, SSH files that may contain private keys, and AWS, Azure and Google Cloud configuration data. Put the two modules together and the picture is a single infection yielding the keys to a developer’s AI accounts, code repositories, and cloud environments in one pass. Symantec’s analysis adds the consequence that follows from that combination: stolen API keys and session tokens let an intruder operate as the legitimate developer, bypassing trust-based access controls, and potentially exposing connected repositories, cloud services, and continuous integration pipelines. Keys can also be monetized directly by reselling access or consuming the victim’s API quota — a practice sometimes called LLMjacking, where someone else runs up your AI bill.

Beyond the developer-specific haul, Aokigahara behaves like a conventional infostealer: browser credentials and cookies, screenshots, clipboard contents, wallet data, messaging, VPN and email application data. That breadth matters for the response, because cleaning up only the AI accounts after an infection would leave the rest of the stolen identity in the attacker’s hands.

What is confirmed, and what is only possible

One discipline this story rewards is separating Check Point’s findings from its warnings. The findings: the malware exists, it is in the wild, it contains modules that deliberately target AI-tool credential files, and earlier versions of the same family were known under names including Kamidere or Stygian. The warnings: if stolen credentials or session tokens remain valid, they could expose private conversations, development data and paid AI services; attackers might consume paid services or resell compromised accounts; and stolen access revealing sensitive business content could enable data extortion. Check Point describes these as potential outcomes, not confirmed activity by Aokigahara’s operators, and says the operators’ monetization methods remain unconfirmed.

That distinction should shape how seriously you take the story, in both directions. It is not a reason to shrug — the collection capability itself is confirmed, and valid tokens are valuable whether or not this particular operator has cashed in yet. And it is not a reason to panic about a breach at OpenAI or Anthropic, because no such breach is part of this story. The providers’ systems are not reported compromised. Your computer is the compromised part, if anything is.

What this means for you

If you use AI coding tools on any machine, treat their stored logins the way you already treat cloud credentials — because attackers now do. In priority order:

  • Revoke sessions, don’t just change passwords. A changed password does not kill an already-stolen session token on every service. Use each AI provider’s account security page to sign out all sessions and revoke API keys you cannot account for, then re-authenticate only the devices you still use. Do this first, before rotating anything else, because a live token is the fastest path back in.
  • Rotate API keys and secrets the tools touched. Any API key stored in a .env file, a Codex configuration, or a local tool config on an exposed machine should be treated as compromised: revoke it at the provider and issue a fresh one. The same applies to Git credentials and SSH keys on that machine, and to cloud access keys in AWS, Azure or Google Cloud configuration files.
  • Check for unexpected usage, not just unexpected logins. Review API usage and billing for spikes, new keys or tokens you did not create, and unfamiliar repositories, projects or cloud resources. LLMjacking shows up on the bill before it shows up anywhere else.
  • Separate your AI tools from your crown jewels where you can. Do not run AI assistants on a machine that also holds production cloud credentials if you can avoid it, and do not store production secrets in the same environment files your coding tools read. The blast radius of one infected laptop is exactly the set of credentials that laptop can reach.
  • Treat a single infection as a full-identity incident. Because Aokigahara also takes browser, wallet, messaging, VPN and email data, a machine that had it needs the full response — password resets, session revocations, and credential rotation across the board — not just a ChatGPT password change.

The bigger pattern

Aokigahara lands in a month full of stories about AI systems being turned against their users — AI agents acting beyond their instructions, AI-found vulnerabilities being exploited within days, and AI supply chains being poisoned. This one is quieter than those, and in some ways more practical: it does not need a breakthrough in AI capability or a flaw in a frontier model. It needs only the ordinary reality that developers leave powerful credentials lying around on laptops, and that those credentials are now worth stealing on their own terms.

The fix is equally ordinary, which is the good news. Session revocation, key rotation, usage monitoring and credential separation are all things a careful developer or team can do today, without waiting for a vendor patch — because there is no vendor patch for “your own files were read off your own computer.” The patch, in this case, is treating AI logins as credentials. They always were. Attackers have simply caught up.

Related reading

Sources

  • Check Point Research, “Infostealers Are Targeting AI: What Aokigahara Infostealer Reveals About the New Developer Attack Surface,” October 23, 2026 — https://blog.checkpoint.com/ai-security/infostealers-are-targeting-ai-what-aokigahara-infostealer-reveals-about-the-new-developer-attack-surface/
  • Cryptika, “New Aokigahara Malware Targets ChatGPT, Claude, Codex, and Cursor Login Credentials,” October 27, 2026 — https://www.cryptika.com/new-aokigahara-malware-targets-chatgpt-claude-codex-and-cursor-login-credentials/
  • The Daily Tech Feed, “Aokigahara Malware Hijacks Credentials From AI Dev Tools,” October 27, 2026 — https://thedailytechfeed.com/aokigahara-malware-hijacks-credentials-from-ai-dev-tools/
  • Symantec Threat Hunter Team, Aoki infostealer analysis (AI-tool credential targeting; files including .claude.json, Claude desktop cookies, ChatGPT cookies, Codex config.toml and .env) — https://cybersecuritynews.com/new-aoki-malware/ and https://gbhackers.com/aoki-infostealer-targets-ai/

Last verified: October 27, 2026.

Related: University of Copenhagen Breach: 525,000 People, and the Test System That Held Their Data — a test environment holding real identity data on 525,000 people, plus 20,000 door PINs. Stolen credentials are one entry point; a staging system full of real data is another.

Related: Keystone Is Destroying 18,835 Hardware Wallets After Hackers Stole Its Device Verification Key — a stolen verification key means a counterfeit can pass the authenticity check. Stolen credentials are one entry point; a trust check that can be faked is another.

Shoaib Hassan

Shoaib Hassan is the founder and editor of AuTechWire, an independent technology publication covering broadband, mobile networks, privacy, startups, and consumer tech.

Related Stories

Leave a Comment