Aoki infostealer now steals Claude, Codex, Cursor and Gemini credentials, Symantec says

Research · Claude; Codex; Cursor; Codeium; Gemini; other AI coding assistants (targeted) · HIGH

Incident dateFirst seen earlier in 2026 (Symantec); AI coding-assistant collection is a recent addition (first AI-targeting sample date not stated)

DisclosedOct 15, 2026 (Symantec Threat Hunter Team on SECURITY.COM; Broadcom protection bulletin the same day)

Added hereOct 15, 11:45 AM ET

Last verifiedOct 15, 2026

Summary

Symantec's Threat Hunter Team reported on Oct 15, 2026 that newer builds of the Aoki (also called Aokigahara) infostealer collect credential and session files used by AI coding assistants, including Anthropic's Claude, OpenAI's Codex, Cursor, Codeium and Google Gemini. Older Aoki samples did not look for AI-related files, so the capability appears recent. The newest sample Symantec described also took GitHub Copilot, JetBrains AI Assistant and Kiro tokens, plus AWS credentials, Claude desktop cookies, ChatGPT cookies, .claude.json, and Codex config.toml and .env files. Stolen API keys and session tokens can let an attacker act under a developer's identity and quota (sometimes called LLMjacking) and may reach linked repositories, cloud services and CI/CD pipelines. This is malware on already-infected machines, not a flaw in those tools. Symantec says it does not know which group is behind Aoki. It is a different malware family from Warden Stealer, which we covered separately.

Severity

HIGH High (VibeIncidents editorial rating): stolen AI coding-assistant tokens can be used under the developer's identity and can reach connected repositories, cloud services and CI/CD pipelines, per Symantec. It needs an already-infected machine, and Symantec gives no victim count.

Timeline

Earlier in 2026
Aoki is first seen; older samples do not target AI-related files (per Symantec).
Oct 15, 2026
Symantec's Threat Hunter Team publishes its analysis on SECURITY.COM, and Broadcom posts a protection bulletin.

How it happened

Aoki gathers whatever data it can find on an infected machine and sends it to its command-and-control server through a /gate endpoint. Symantec says it has no backdoor command list. Newer samples added AI coding-assistant targets: .claude.json, Claude desktop cookies, ChatGPT cookies, Codex config.toml and .env files, and tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro, along with AWS credentials. It takes credential, token and session files rather than source code, except for Cursor's local state database, which can cache chat context and code snippets. It also steals from dozens of browsers, crypto wallets, password managers, messaging, gaming, VPN and FTP apps. Symantec detects it as Infostealer.Aoki, and the name comes from an Aokigahara string the malware uses during decryption. Symantec sees no links to any existing malware family. Warden Stealer, reported by Gen Digital on Oct 8, 2026, is a separate family going after similar AI agent data.

How to check your app

If a machine may be infected, rotate the Claude, Codex, Cursor, Gemini, Copilot, JetBrains AI Assistant and Kiro tokens and AWS keys stored on it, and review access to linked repositories and CI/CD.
Keep AI tool config and token files out of world-readable paths, and use OS keychains or short-lived tokens where the tool supports them.
Use endpoint protection that detects Infostealer.Aoki; Symantec's article and Broadcom's bulletin cover detection.

Sources

Corrections and updates

None. Re-checked against every source on Oct 15, 2026.