Infostealers Are Targeting AI: What Aokigahara Infostealer Reveals About the New Developer Attack Surface

AI assistants have quickly become part of everyday work, particularly for developers. Tools such as ChatGPT, Claude, Cursor and GitHub Copilot increasingly sit alongside source code, cloud environments and other sensitive business resources, making the credentials and sessions connected to these tools increasingly important to protect.

New research from Check Point Research (CPR) into the Aokigahara infostealer shows how attackers are adapting to this shift. The malware specifically collects authentication files, session data and configuration files associated with popular AI applications and development tools.

The significance goes beyond gaining access to an AI account. If stolen credentials or session tokens remain valid, they could potentially expose private conversations, development data and paid AI services. Aokigahara also targets Git credentials, SSH-related files and cloud configurations, showing how AI access is becoming part of a wider developer and identity attack surface.

Key Takeaways

• AI applications are explicit targets. Aokigahara targets data associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI and other tools.
• Developer and cloud environments are also in scope. The malware collects Git credentials, SSH-related files and AWS, Azure and Google Cloud credentials and configurations.
• Stolen AI sessions could expose sensitive information. Valid credentials could potentially provide access to private conversations, source code and other business information.
• Compromised access could have financial value. Stolen credentials could potentially enable unauthorized use of paid AI services or resale of compromised accounts, although CPR has not confirmed how Aokigahara’s operators monetize the data.

What Is the Aokigahara Infostealer?

Aokigahara is a newly observed infostealer identified in the wild and analyzed by Check Point Research. Like other information stealers, it has a broad range of data-theft capabilities targeting browser passwords and cookies, cryptocurrency wallets, email applications, password managers, VPNs and other software.

What makes Aokigahara particularly notable is its dedicated targeting of AI applications and development tools. Its collection routines target Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI and JetBrains AI Assistant, among other tools.

The targeting reflects an expansion of the information potentially valuable to attackers. Alongside traditional credentials and financial information, AI authentication files and session data have now become part of the malware’s collection scope.

How Does the Aokigahara Infostealer Work?

Once active on a compromised device, Aokigahara uses dedicated collection modules to gather different types of information. Alongside traditional targets such as browser credentials, cookies, cryptocurrency wallets, password managers and email applications, specific modules search for data associated with AI applications and development environments.

Its AI-focused module targets authentication files, session data and configuration files associated with tools including Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI. Depending on the application, these files may contain authentication tokens, credentials or session information that could potentially provide access to the service.

A separate module focuses on the wider development environment. It searches for Git credential files, SSH-related files that may contain private keys, and AWS, Azure and Google Cloud credential and configuration files. This means the malware’s collection can potentially reach from an AI assistant into the credentials used to access source code repositories, cloud resources and other development services.

The collected information is packaged into encrypted ZIP archives and uploaded to the attacker’s command-and-control server. Aokigahara separates the stolen information by collection type, including a dedicated category for AI session data, before completing the upload process.

Why Are Infostealers Targeting AI Applications?

AI assistants are increasingly used in workflows where employees interact with source code, documents and sensitive business information. That makes the credentials and sessions connected to these services potentially valuable too.

Aokigahara searches for files associated with AI applications that may contain authentication tokens, credentials, session information or configuration data. Not every targeted file necessarily contains an authentication secret, but if valid credentials or session tokens are stolen, they could potentially allow an attacker to access an AI service without entering the user’s password.

The potential impact goes beyond unauthorized use of an AI account. Depending on the service and account, compromised access could potentially expose private conversations, source code or other sensitive information, while also allowing unauthorized use of paid AI services.

Importantly, CPR has not confirmed that Aokigahara’s operators have reused or sold stolen AI credentials. The research demonstrates that the malware is designed to collect this information and what that access could potentially enable.

Why Are Developer and Cloud Credentials Also at Risk?

The breadth of Aokigahara’s collection provides an important view into the modern developer endpoint. AI assistants do not exist in isolation. They can sit on the same device as source code, development tools and credentials providing access to cloud infrastructure and repositories.

Aokigahara’s AI and developer collection capabilities operate as separate modules, so the research does not establish that attackers deliberately combine these credentials into a single attack path. However, their inclusion within the same infostealer shows how many potentially valuable access points can exist on one compromised developer device.

For organizations, this makes endpoint compromise particularly significant. An information stealer does not necessarily need to choose between targeting an AI account, Git credentials or cloud access when information associated with all of them may be available on the same machine.

What Is the Business Risk of Stolen AI Access?

The impact of compromised AI access ultimately depends on what sits behind an authenticated session. Employees may share business information, proprietary source code and other confidential material with AI services as part of their everyday work.

If stolen credentials or session tokens provide access to conversation histories or uploaded files, attackers could potentially gain access to that information as well. Compromised credentials could also potentially be used to access paid AI services, generate unauthorized charges or be resold as account access.

There is also a potential extortion risk. If an attacker gains access to sensitive conversations, files or source code, that information could potentially be used as leverage to demand payment. CPR has not observed Aokigahara operators carrying out these activities, so these should be understood as potential outcomes of the access the malware attempts to collect.

How Should Organizations Protect AI Credentials and Sessions?

The Aokigahara findings point to a practical shift in how organizations should think about AI security. AI credentials and authenticated sessions should be treated with the same care as other sensitive identity assets.

Organizations should consider:

• Protecting AI credentials and sessions: Treat tokens, authentication files and application sessions as sensitive credentials.
• Controlling sensitive information shared with AI: Establish clear policies around source code, business data and confidential information that can be entered into AI services.
• Securing developer environments: Protect Git credentials, SSH keys and cloud credentials stored on developer endpoints.
• Monitoring endpoints for information-stealing malware: Compromising the device itself can give attackers access to multiple credentials and applications at once.
• Reviewing access following an endpoint compromise: AI sessions and credentials should be considered when investigating credential exposure, alongside browser, cloud and developer credentials.

AI Is Becoming Part of the Identity Attack Surface

Aokigahara highlights a broader change in the information attackers are interested in stealing. As AI assistants become embedded in everyday development and business workflows, the credentials and authenticated sessions that provide access to them are becoming valuable assets too.

For organizations, protecting what employees enter into AI applications is therefore only part of the challenge. The credentials and sessions providing access to these services also need protection, particularly when they sit on the same endpoints as source code, Git credentials and cloud access.

The key takeaway from Aokigahara is that AI credentials and session data should now be treated as sensitive assets alongside browser sessions, cloud credentials and developer keys. Their inclusion in the malware’s collection capabilities provides another indication of how the attack surface is evolving alongside the way organizations adopt AI.

To learn more, read the full research from Check Point Research here.