Symantec: Aoki Infostealer Now Targets AI Coding Assistant Credentials
Symantec reports that the Aoki malware has evolved to harvest API keys and session tokens from popular AI development tools, posing new risks to developer identities.
Key points
- Aoki now targets credentials for Claude, Gemini, Cursor, and other AI coding assistants.
- Stolen tokens allow attackers to bypass safeguards and access linked repositories and CI/CD pipelines.
- Symantec views this shift as evidence that AI credentials are now as valuable as financial data.
Symantec researchers warned on October 15 that new versions of the Aoki infostealer are actively targeting credential and session files used by popular artificial intelligence coding assistants. This marks a significant operational shift for the malware, which previously focused exclusively on harvesting data from web browsers, cryptocurrency wallets, and password managers.
The latest iterations of the stealer are designed to locate and exfiltrate specific configuration files and cookies associated with AI tools. According to the report published in Infosecurity Magazine, the malware now targets Anthropic’s Claude, OpenAI's Codex, SpaceX’s Cursor, and Google’s Gemini. This expansion allows threat actors to bypass traditional security assumptions that request traffic originates from trusted, legitimate users.
Expanding Target List
The newest version analyzed by Symantec’s Threat Hunter Team specifically sought out the .claude.json file, Claude desktop cookies, and ChatGPT cookies. It also targeted the Codex config.toml and .env files, which often contain sensitive environment variables. The researchers noted that the capability to steal AI-related files is a recent development that appears to be expanding rapidly within the Aoki codebase.
In addition to the aforementioned tools, the malware harvested tokens for GitHub Copilot, JetBrains AI Assistant, and Kiro. The report also highlighted that Aoki continues to target Amazon Web Services (AWS) credentials, indicating a broad interest in cloud infrastructure access alongside AI development tokens.
Value of AI Credentials
Symantec researchers emphasized that this evolution suggests threat actors now consider AI credentials to be just as valuable as payment card data and cryptocurrency wallets. Unlike stolen credit card numbers, which are typically resold or used for fraudulent purchases, stolen AI keys can be used to run up usage on a victim’s account.
This practice, sometimes referred to as LLMjacking, allows attackers to monetize the victim's API quota directly. Furthermore, the stolen tokens can expose connected repositories, cloud services, and continuous integration and continuous delivery (CI/CD) pipelines linked to the compromised account. This provides attackers with a potential route into the developer’s wider technical environment.
What should you do?
Symantec stated that the Aoki infostealer is a highly capable and multi-functional tool whose capabilities appear to be in active development. The researchers do not know which specific threat group is behind the malware and found no indications linking it to any existing malware family. Aoki was first observed earlier in 2026, but documentation regarding its capabilities has been sparse until this recent update.
That suggests organizations should treat AI development credentials with the same rigor as financial data, given their dual utility for direct monetization and lateral movement within development environments.
What to do and how to stay safe: Aoki
- Audit local file systems for known AI configuration files such as .json, config.toml, and .env files to ensure they are not stored in plain text or exposed directories.
- Implement strict access controls and least-privilege principles for API keys and tokens used in development environments to limit the blast radius of a compromise.
- Monitor for unusual API usage patterns or unexpected requests from unfamiliar IP addresses, which may indicate that stolen tokens are being exploited.
- Once the vendor provides an update, ensure endpoint detection and response tools are configured to detect file access patterns associated with infostealers.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which AI coding assistants are targeted by the new Aoki versions?
The malware targets Anthropic’s Claude, OpenAI's Codex, SpaceX’s Cursor, Google’s Gemini, GitHub Copilot, JetBrains AI Assistant, and Kiro.
How do attackers monetize stolen AI credentials?
Attackers can cash in stolen keys by running up usage on the victim's account, a practice known as LLMjacking, or by reselling the credentials.
Is Aoki linked to any known threat group?
Symantec does not know which threat group is behind Aoki and found no indications linking it to any existing malware family.
