The Aokigahara Infostealer Is Hunting Your AI Coding Assistant Tokens — Here Is How to Shut That Door

In the week of October 19, 2026, Check Point Research and Symantec published analysis of a Windows infostealer named Aokigahara (also tracked as Aoki). On its own, another infostealer is not news — these things are a commodity. What makes this one worth a security team’s attention is the list of things it was taught to steal. Alongside the usual browser passwords, cookies, and crypto wallets, Aokigahara reaches for the authentication files, session data, and configuration of AI coding assistants: Claude, ChatGPT Desktop, OpenAI Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and JetBrains AI Assistant. And in a separate collection module, it goes after Git credentials, SSH private keys, and AWS, Azure, and GCP credential files.

If you lead a platform, security, or engineering team that has let AI coding agents into the development workflow — and in 2026, that is most of us — this is a signal worth acting on. The developer laptop was always a sensitive endpoint. What changed is that it now holds a new, high-value class of credential that your existing controls were probably never pointed at. This post walks through what Aokigahara actually does, why AI session tokens are such a prize, and a concrete plan to make sure that a single compromised workstation does not become a path into your cloud. None of this requires panic. The failure modes are understood, and so are the fixes.

What Aokigahara Actually Does

Aokigahara is a newly observed infostealer analyzed independently by Check Point Research and Symantec in October 2026. Functionally, it behaves like the broad family of commodity stealers that has been active for years: once it runs on a machine, it sweeps the system for anything that looks like a credential or a session, bundles it up, and ships it to a command-and-control server.

The capability that earns it a headline is a dedicated collection routine for AI tools. According to Check Point’s analysis, Aokigahara runs an AI-focused module that targets authentication files, session data, and configuration files for a specific list of assistants, and a separate developer-environment module that searches for Git credential files, SSH-related files that may contain private keys, and AWS, Azure, and GCP credential and configuration files. The collected data is sorted by type — including a dedicated category for AI session data — packed into encrypted ZIP archives, and uploaded to the attacker.

Two details matter for how you reason about the risk:

• The AI-targeting is a recent addition. Symantec noted that earlier versions of the malware did not go after AI-related files. The capability was bolted on, which tells you the operators see value in it. Attackers do not invest engineering effort in collection routines nobody will pay for.
• The two modules are, as analyzed, independent. Check Point was careful to say the research does not establish that attackers deliberately chain the AI credentials and the cloud credentials into a single attack path. What it establishes is quieter and arguably more important: all of these valuable access points can sit on one machine, and one piece of malware can harvest all of them in a single run.

Check Point also did not confirm how the operators monetize the stolen AI access. So treat the downstream scenarios — account resale, unauthorized use of paid AI services, exposure of private conversations and source code, extortion based on what the attacker finds — as potential outcomes of the access, not observed behavior. That distinction matters for honest risk assessment. The access is real; what gets done with it is, for now, an open question.

Why AI Session Tokens Are Suddenly Worth Stealing

To understand why this is more than “yet another stealer,” you have to look at what an AI coding assistant is on a developer’s machine in 2026.

These tools are not isolated chat windows. They sit directly alongside source code, they are authenticated to accounts that may hold conversation history and uploaded files, and — in the case of coding agents — they frequently have the ability to run shell commands, call cloud APIs, and touch databases using the developer’s own access. We have written before about why AI coding agents become an identity and credential risk and why that makes them a genuine attack surface rather than a convenience feature. Aokigahara is the logical next move by the people who make money from stolen access: if the tool holds the keys, steal the tool’s keys.

There are three reasons a stolen AI session token is attractive:

1. It can bypass the password and MFA. A valid session token or authentication file often represents an already-authenticated session. An attacker who replays it may not be prompted for the password or a second factor at all. This is the same reason browser-cookie theft has been so effective for so long — the session is the credential.

2. The account sits next to everything that matters. Developers routinely paste source code, internal documentation, architecture notes, and sometimes secrets into these tools. A hijacked session can expose that history. And because the AI tool lives on the same endpoint as Git and cloud credentials, the machine that leaks the AI token is very likely leaking the rest too.

3. Agentic access multiplies the damage. If the compromised tool is a coding agent with standing cloud credentials — a long-lived AWS key in an environment file, a broad IAM role, a standing database connection — then the stolen session is not just a window into a chat. It is a handle on whatever the agent can reach.

That third point is the one to sit with. The industry spent a decade learning that standing privilege is the thing that turns a small compromise into a large one. AI coding agents reintroduced standing privilege through the back door, because the fastest way to make an agent “just work” is to hand it the developer’s long-lived keys. Aokigahara is a reminder that those keys are now sitting on disk, in predictable locations, waiting for a stealer that knows where to look.

The Root Cause: A New Credential Class on an Old, Soft Endpoint

It is worth naming the underlying problem precisely, because the fix follows directly from it.

The developer workstation has always been a soft target. It is a general-purpose machine, it runs code from the internet all day, and it holds credentials to the systems that build and ship your product. What is new is not the softness of the endpoint — it is the concentration of a new, poorly governed credential class on top of it.

Most organizations have reasonably mature controls for some of these credentials and none at all for others:

• Cloud keys — many teams know these should not be long-lived and sitting in ~/.aws/credentials, even if they have not finished fixing it.
• SSH and Git credentials — widely understood, often protected with passphrases and hardware keys, though inconsistently.
• AI assistant session tokens and config files — almost entirely ungoverned. There is usually no policy on where they live, how long they last, whether they can be revoked centrally, or what happens to them when an endpoint is suspected of compromise.

Aokigahara exploits that last gap. The malware did not break any cryptography or find a zero-day in Claude or Cursor. It read files off disk — files that are sensitive, that live in predictable places, and that most teams were not treating as secrets. The problem is not that the stealer is clever. It is that an entire category of credential arrived faster than the governance around it.

The Remediation Guide: Containing the Blast Radius

Here is the good news, and we mean it: everything below is achievable with controls you already understand. You do not need a new category of product to respond to this. You need to apply identity discipline to a credential class that has been escaping it.

Work the list in two passes — first the endpoint, then the far more important question of what a stolen credential can actually reach.

Pass one: harden and monitor the endpoint

1. Treat AI credentials and sessions as secrets. Write it into policy explicitly: authentication files, tokens, and configuration for AI assistants are sensitive identity assets, handled with the same care as cloud keys. This is the single most useful thing you can do this week, because you cannot govern what you have not named.
2. Keep EDR honest about stealers. Aokigahara is a Windows infostealer that behaves like its peers — broad file collection, archive creation, outbound exfiltration. Make sure your endpoint detection is tuned to flag mass credential-file access and unexpected outbound archive uploads, not just known malware hashes.
3. Set policy on what goes into AI tools. Establish clear, enforceable guidance on the source code, business data, and secrets that may be entered into AI services. You cannot steal from a conversation history what was never pasted into it.
4. Rotate on suspicion, not on proof. If an endpoint is suspected of compromise, include AI sessions and tokens in the rotation checklist alongside browser sessions, cloud keys, and developer credentials. Historically, incident responders have not thought to revoke an AI assistant’s session. They should now.

Pass two: make the stolen credential worth less

This is where the real leverage is. Endpoint hygiene reduces the odds of a theft; limiting standing privilege reduces the cost of one. Assume a laptop will eventually be compromised, and design so that the credentials on it are not a master key.

5. Kill standing cloud credentials on developer machines. The long-lived AWS, Azure, or GCP key in an environment file is the worst thing Aokigahara can find, because it is valid for as long as it exists. Replace it with short-lived, scoped, Just-in-Time access that is granted on request and automatically revoked. A stolen credential that expired twenty minutes ago is a non-event.
6. Extend the same thinking to the AI agent itself. If a coding agent needs to reach your cloud, broker that access through a short-lived, scoped grant rather than handing it the developer’s standing keys. We have made the detailed case for why AI agents need JIT rather than better key vaulting — the summary is that vaulting still produces a live credential that lands on disk, and a stealer reads disk.
7. Remove standing database access the same way. SSH keys and database credentials on the endpoint deserve the same treatment as cloud keys: scoped, time-bound, auditable, and revocable centrally.
8. Know your blast radius before you need to. When an endpoint is compromised, the question that decides whether this is a cleanup or a crisis is “what could the credentials on that machine reach?” Being able to answer that quickly — which identities, which cloud resources, which data — is the difference between a scoped response and a company-wide fire drill. This is exactly the kind of correlation an attack-path view is built to give you.

Where Cloudanix Fits

We did not build Cloudanix in response to Aokigahara, but the controls that answer it are the ones we have been shipping, because they answer a whole class of these incidents, not one stealer.

The honest framing is this: you cannot stop every infostealer from landing on an endpoint. What you can do is make sure the credentials it finds are short-lived, scoped, and revocable — so a theft becomes an expired token instead of a live key into your cloud.

• Just-in-Time access for humans, non-human identities, and AI coding agents means the credentials sitting on a developer’s machine are short-lived and scoped by default. Aokigahara can still read the file; it just reads a credential that is already dead or about to be.
• The Coding Agent Firewall provides on-host DLP for AI coding assistants — the control designed for exactly this endpoint, blocking secret and PII exfiltration before a token leaves the machine.
• A unified asset graph lets you answer the blast-radius question in one query when an endpoint is compromised, rather than stitching the picture together from five tools during an incident.

If you want to see what your exposure looks like today — which identities carry standing privilege, where long-lived keys live, and what a compromised developer endpoint could actually reach — that is the kind of thing a free assessment surfaces quickly.

The Takeaway

Aokigahara is not a sophisticated breach of your AI tooling. It is a commodity stealer that got taught where the new keys are kept. That is precisely why it matters: it is a preview of what every stealer will do by default within a year, now that AI session tokens have proven valuable.

The teams that come through this well will not be the ones who banned AI coding tools — that ship has sailed, and the productivity is real. They will be the ones who treated AI credentials as the sensitive assets they are and, more importantly, made sure that the credentials living on a developer’s laptop were never a standing master key in the first place. If the worst a stealer can grab is a twenty-minute, narrowly-scoped token, you have turned a potential incident into a log entry. That is a win you can engineer today.