Aoki Infostealer Now Harvests AI Coding Assistant Credentials
Malware variants are stealing API keys from tools like Cursor and Claude, risking infrastructure access without a vendor breach.
Key points
- Aoki malware now targets AI coding assistants including Cursor, Claude, and GitHub Copilot.
- Stolen tokens allow attackers to consume API quotas and potentially access repositories.
- Symantec reports active development but no confirmed downstream exploitation yet.
Symantec researchers have documented that the Aoki infostealer, also known as Aokigahara, now includes routines to harvest credentials from popular AI coding assistants. This evolution marks a significant shift in the malware’s capabilities, which previously lacked the ability to target these specific applications.
The threat hunter team identified newer variants that specifically seek out authentication material stored by development tools such as Claude, ChatGPT, OpenAI Codex, Cursor, Codeium, and Gemini. These additions appear alongside the malware’s traditional targets, which include browser cookies and cryptocurrency wallet data, indicating a broadening scope for the attackers.
Context and Background
According to Symantec, the Aoki malware was first observed earlier in 2026. At that time, it did not possess the code necessary to extract data from AI applications. The presence of these new collection routines in recent samples suggests that the threat actors are actively developing the tool to exploit the growing adoption of AI-powered development environments.
This finding aligns with earlier reporting by Threat Times, which noted in October 2026 that Aoki had begun targeting AI credentials. The current analysis confirms that the malware’s developers are continuing to refine their methods to capture session tokens and API keys from these increasingly popular tools.
Who Is Affected
The immediate risk involves the theft of OAuth tokens and API keys, which can allow attackers to operate under a legitimate developer’s identity. This could lead to unauthorized consumption of AI services, a practice sometimes called LLMjacking, or the resale of stolen access credentials. Symantec stated that they have not established whether downstream exploitation has occurred in this specific campaign.
Compromised authentication material could expose connected infrastructure depending on the permissions granted to the stolen tokens. This includes potential access to software repositories, cloud services, and continuous integration and continuous delivery pipelines. The malware also continues to target conventional assets like Chromium and Firefox browsers, VPN software, and password managers.
What should you do?
Symantec noted a lack of visibility into the total number of affected victims, making it difficult to distinguish between demonstrated collection capabilities and confirmed operational consequences. The findings concern credentials harvested from compromised endpoints rather than a reported breach of the AI providers themselves. Users should monitor for unusual API usage and review token permissions regularly.
What to do and how to stay safe: Aoki
- Review active API tokens and session keys for AI coding assistants and revoke any that are no longer needed.
- Enable multi-factor authentication on all developer accounts and connected cloud services to reduce credential reuse risks.
- Monitor API usage dashboards for unusual consumption patterns that could indicate unauthorized LLMjacking activity.
- Scan endpoints for known Aoki indicators and check for unauthorized access to browser data or wallet files.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this mean the AI companies have been hacked?
No, the findings concern credentials harvested from compromised user endpoints, not a breach of the AI providers themselves.
Which AI tools are specifically targeted by the new Aoki variants?
The malware targets Claude, ChatGPT, OpenAI Codex, Cursor, Codeium, and Google Gemini, alongside other development tools.
Has anyone confirmed that attackers are using these stolen keys?
Researchers have not established downstream exploitation in this campaign, though the capability for unauthorized access exists.
