A newly observed Windows infostealer called Aokigahara is targeting login credentials and session data associated with ChatGPT Desktop, Claude, Codex, and Cursor.

The malware searches infected computers for authentication files and application storage, extending familiar password theft into the AI tools developers increasingly use for everyday work.

The threat is not evidence that these AI services have been breached. Instead, attackers collect locally stored information that may help them access accounts.

Similar AI coding agent theft has shown why tokens, saved connections, and project records deserve the same protection as browser passwords and cloud keys.

Researchers from Check Point identified Aokigahara in the wild and detailed its capabilities in an October 23 research report.

New Aokigahara Malware

They noted that an earlier version may have been known as Kamidere or Stygian, while stressing that the operators’ methods for making money from stolen information remain unconfirmed.

A dedicated collection module named aisessions searches for data linked to Claude Code, Claude Desktop, Codex, ChatGPT Desktop, and Cursor.

Its scope also covers Windsurf, GitHub Copilot, Gemini CLI, JetBrains AI Assistant, Amazon Q, and Kiro. The module additionally queries Windows Credential Manager for stored credential information.

For Claude, collection targets include credential files and desktop application folders. Codex targets include authentication, configuration, and environment files.

Cursor’s local storage databases are also selected, while ChatGPT Desktop’s application cache is searched. These locations may contain useful secrets, but not every targeted file necessarily holds a password or token.

Earlier reporting on Aoki credential stealing described similar interest in AI application data. The practical risk depends on whether collected secrets remain valid and reusable: working session tokens could give attackers account access without requiring them to enter the victim’s password again.

That access could expose private conversations, uploaded material, or development information. Attackers might also consume paid services or resell compromised accounts.

Check Point described these as potential outcomes, not confirmed activity by Aokigahara’s operators, and raised possible data extortion where stolen access reveals sensitive business content.

A separate ide module widens collection to Git credentials, SSH files that may contain private keys, and AWS, Azure, and Google Cloud configuration data.

Alongside its AI focus, Aokigahara steals browser credentials and cookies, captures screenshots and clipboard contents, and collects wallet, messaging, VPN, and email application data.

Evasion, Encrypted Uploads, and Incident Response

Aokigahara includes optional checks designed to frustrate malware analysis. Depending on configuration, it examines debugger indicators, virtual machine traces, hardware resources, process counts, and mouse movement.

It can also stop running when keyboard or Windows interface language settings match an excluded group, including Russian, Ukrainian, and several regional languages.

Its configuration is encrypted with AES-256-CBC and controls which built-in collection modules execute. It also stores server details, communication settings, and fallback destinations.

Importantly, disabled collection modules remain embedded in the executable, so the capabilities present in a sample may exceed those enabled during a particular run.

The malware packages collected information into ZIP archives, then encrypts uploads using AES-256-GCM. An X25519 key exchange helps establish the encryption key.

Separate requests open an upload session, transfer each collection category, and mark completion. The latest analyzed samples use a Windows-looking User-Agent string, although that string alone cannot prove infection.

Upload headers identify the collection category and sequence number, allowing the server to separate browser data from AI sessions and other stolen material.

The final completion message signals that the upload phase ended; it does not independently confirm that every stolen archive reached the server.

The wider trend is already visible in incidents involving a fake Gemini npm package that targeted local data from several AI tools.

That separate campaign does not establish Aokigahara’s delivery method; it shows how developer workflows have become attractive places to collect reusable access credentials.

For defenders, the collection pattern supports monitoring unexpected processes that read AI authentication stores, editor databases, cloud credentials, and SSH material.

Network findings should be checked alongside endpoint evidence rather than treated as standalone proof. Check Point also published a YARA rule to support identification of the malware.

After a suspected infection, responders should isolate the device and use a clean system to revoke AI sessions, rotate exposed keys, and review connected cloud and repository accounts.

Resetting passwords alone may leave stolen sessions usable. Teams should also review AI account activity and determine whether sensitive conversations or uploaded files were accessible.

The findings concern theft from compromised endpoints, not a demonstrated vulnerability in ChatGPT, Claude, Codex, or Cursor.

Organizations should therefore include AI application sessions in their existing infostealer response plans rather than treating them as ordinary application settings.

Indicators of compromise (IoCs):-

Type	Indicator	Description
IP address and port	`2[.]26[.]252[.]48:8080`	Aokigahara command-and-control infrastructure
Domain	`dfwioeiofwr[.]info`	Aokigahara command-and-control infrastructure
Domain	`dobeqnesmot[.]cc`	Aokigahara command-and-control infrastructure
Subdomain	`gate[.]dfwioeiofwr[.]info`	Aokigahara command-and-control infrastructure
Domain	`hjazfioe[.]surf`	Aokigahara command-and-control infrastructure
Domain	`kkeyyou[.]cc`	Aokigahara command-and-control infrastructure
Domain	`neihite[.]cc`	Aokigahara command-and-control infrastructure
Domain	`somelitersofblood[.]pw`	Aokigahara command-and-control infrastructure
SHA-1	`8d6c86e0af7807f9b5baf15e9f076bb81e012515`	Dropped clipper component

The following table reproduces all 150 Aokigahara sample SHA-1 hashes. Each cell represents a separate sample; columns do not indicate relationships between samples.

Aokigahara SHA-1	Aokigahara SHA-1	Aokigahara SHA-1
`007137599bc4d69ee952a5228b5fcb2c3b9a95a7`	`00d52c7e759d878f0d8a117502f6d854af13f007`	`04eddccb79db41e03a4ee8542e8a33d7f1d9fe18`
`057a2d1dedeb93b7765c455a9e0c469e7cbe4843`	`079ddf5cc7d6ca2e02f860f87d4d18c83db9d331`	`0b74ce90a39278fb97fe94f6306af71cbe679503`
`0c46ac5555cf8f305c1345a21d0802c52bf52cd8`	`0d8d0bad2e08856ba379e425e2e90e49506af631`	`0e76150cee3f2b89f0fbe39106ab2898db109f09`
`0f69792cb926a416766d47a30a05009c13be0d64`	`130f2710cf9863bdd6724e8912600505b6fb7ef2`	`133dc00ad81638e6b0a2f8f163b4d694ce477165`
`151d8013ca3ab3dab9cd37f4ed9870cc83e87a77`	`1701db4fa798b309cb25227408406dde4c69de8a`	`1835f1e0b1eda3dc4b39682ecad3eba88cbbc44e`
`18e041b5a0c668392ff4d036f3f9660c2698311e`	`1a6a6e08a01cc3f1455af2c4ecd59a3d7802cd7a`	`1a7248720f3ac79082841b006582f20799b314a9`
`1a97a18db74f2b6df984c9a188a79b4e65a06b81`	`1cb6ccfdcb277a0277729443d15f17a441fa0eda`	`1cb8dc11bdb8baf342b83079fb650cd6bb1b132d`
`1e072236f87cd914dc583ca2163460d656bfcfba`	`1e94d7f1d501724076fcf98459e14b68321d45f7`	`2045f165d737f2d43ba603d444dfa5d9e6f05805`
`211e45f306b84a82cfe736635c176a424e7479dc`	`21ef070e39f651118a804882374dc2dfa3e38666`	`2362a326070d83c167251873b389bd783781cf6c`
`241e37b8fc5ffeefbd1d89a82b74cf2d92b49eac`	`244371fc1642f0548b807b0a4a2e7ea5d7b4c82a`	`28099fc5a8cbbd40173f8ac0aded9044fdb4a598`
`2cdc77108c585d14b1567053b8f8a58ea78c255f`	`2f30b116ca3dc48ff5783c3bb7391d671866e27b`	`30737fa46f2ff93e33f45008cf306233954ea898`
`324e0fffc7977f8ff591993819123d33c2970953`	`3586eeaf3ffe2c3a4f1d005aee863b7aee7cc7bd`	`3696baa239c479f9f5103618214972890f1a473b`
`385e21a96687a33f79f9cab0627aec7218e1a8f4`	`38b2c29b46086b417181deb958e8b276a9d1fbf4`	`3aaeb49864108c92af50feeb5d9e3b3efaa39818`
`3c56a0c3c59a1425bfdcdffda9e8b308f478b147`	`426bea548a24f7f39c279770b5dd21fbed7f7328`	`4417d2645adb6e7e94959daf483f93058500840f`
`4485feb1385975ef13f08148cdc679f50fa0cc6d`	`456414c0acf463e06f95f5bd3d8355758fca6b53`	`4595d1875441ffb8c076856e366d1f4f5c74a679`
`48c6b66dc4b4d40d72b7460e6fd670b6c03d5d40`	`4b3a4ad0acd43fc8796147381074a98e8e576904`	`4c07021f8b0cdd3ca334a13f9af2bade9e699dc2`
`50060c0fc5fa8932671eb24b03b05d00c2e99951`	`51ae6cad54f33846f83a352457b9a44ef8b7a61d`	`59bbaca8a848215e7e4af7cec320432c51b0b812`
`5ef7eb755f1e3f6bf8586794777466a639057dcb`	`5fadf206dc163f63ebf66f984042b00c67121813`	`5fe11fbb89d33efa712ffb8590626bd88fecab8f`
`61a024f5a42a9a91b0a9871a1613c7fb3ef5613b`	`62dcc9ba2a5eee9dd941ad08766603c89a45869b`	`6393c0d3fb76f771a9418c2d152c621929ee002b`
`63cc5033532cd00bda3d4968b1257629e613505a`	`682dd6392004e1131b1aa3f2351a0bc7adb84d14`	`699c809a116106da40b3f641c11b0db34d0f1c5e`
`6a09fffca381f6624d2def1083284ca486306e7c`	`6c860007f8f49de8e9848b538bd7acdc6bfcdf55`	`6e073a196a9bfa01da418b5783c2395fb22c7ec9`
`6eb8f17dba69f6d25b7f5c529b25d199707b69e2`	`6f7d5935602c188b1e3066b4ab9aeef7b85a8ec2`	`70915fac07af4ad7acc1868fe05dc00b98206f0f`
`70d4007b11e56752fffb81f71c90987f4bb441fa`	`70e91644802053cfa68be6ec0f94207282ff27e4`	`7233a15327dc2f0cca0292e6352eebf6e6e090d8`
`72aa6417a19c45dabdd6c79087fb13c73ae7b823`	`7cc6c75fad93b2482a9c5f4522530007c72f99e0`	`82ebfc09c98bd211ff8b08efcd8ec8b9ce1fb4be`
`83b43ce0ee9881201451c0604fb5b792bd4581f5`	`86230c07e638b85bc8010df1aa9e33ca61fda4cc`	`89f296aef7988bdd59109e4263d0a31c886770aa`
`8b0cf62382f620bbbf5d176295d63ed522ab9c2c`	`8c3111a61fbf30e86b8206397ce3c0017e5ea509`	`8c4c1d8325adb463c34694ce3a5a851e97b81a6f`
`8d7a81119ce7be6eb452192f08fa2669228ff597`	`8d860ca64ce0cbf40871fd66b9e3a513e73cda90`	`8dc40b7208b8c0d95d1ab8dda9a56fff790b3ddd`
`8e9fd1274b77ff9726c4637d008a9d599c9d5f1e`	`9003310bf73dc337b8b50131f1c0724a79161aac`	`90c057dafefbee423e3014266218272d454a0aa3`
`912ed8ce7767f94f62de6a30fb8e9df7c0c512f7`	`9369e0e5eae22cff71b375ad285ea89471f25101`	`97c80e2d382e6e55f61702da3afb838fdec2f4f1`
`98c6649cc256dfadf1af939da46f037b05c0f2e5`	`99b28a20851a3ed29769a469f4dd31ebbb8a83de`	`9d424ce23753ffddc7b39477222123b0f2c33066`
`9f05045f5447d79c8c0d0f5cb589fd85c89620d3`	`9f20034441e78574aec7ad39842a342f939eaf6a`	`a00da33342a5ea5168d851a5c93109e07cf95c49`
`a2abdf1af38da9995a3b6672ce6c34e9e17c39a4`	`a4871f4a61faf74e1cceaffe26901f6076c9f37e`	`a63ded811d412cd0f859891b0c1f066b87bb1b80`
`a84148b4d408544325c20ee04299ae95c762b6a2`	`ad960d2abb1999a7260c5f498532a5bb8754c2a5`	`ae9d6b1a32a45b05edb920538e538a3d6a5fe439`
`af196456d2ebf9556ab239661922565e1bca9ac0`	`b335483800d35a29c25767c917725e24c21b0f2b`	`b33e59c598845d2547ddc7f654115df2284bb3ae`
`b36d0796e33f808eaeb33b33908327a410680c56`	`b4491f1919a88deedebe7fba56b593e7d6655458`	`b523d56d82485253f2e3619437c8398b7ee0f20d`
`b607025d3e06d1e8cffcd398c64871d7fcd92bf4`	`b6f0dfd3aa2fc7b8b2ad432c4a4276da23ceb46b`	`bab4c910e3c98085bf228519f346d071a75e44e3`
`bad339c5ad65808285b0e87498f2ea6f669417d9`	`c00aceaa40b38e48f662ac927bb86302934aaf96`	`c2e28ba5523c1f3a545a0b4a00a9d5e9c8ae7583`
`c323c59815082ac842f0bafcc01f537444e1cc5a`	`c5b50b5e14dfb5e028dfd88a4e4fb960dd650b52`	`c810acdf30bcdfc6e8021e7f62a3bcce0828c2ee`
`c8456bb71a74ed6305455c318295b8a39e9277f3`	`cbdff0df0dbdbc3c1845d208661dd75fd335ef93`	`cc12fcb9e5e6f7afde66f5c3452ed6e3cd6d5390`
`cc708ae3d7aa084279122c0db7250096f750d6b0`	`d34491da5aa159314129c0ff67f957d873703e35`	`d3c90275dd7279a791d717676be15789376f7aa7`
`d8bfff5139b54b6f98f07c051cd25d7aa465fec8`	`da986a3cb2ce67456ef374fbdd957d370a1a4367`	`daef439e1f110d624ce50fe0f9d9d24f61f7497b`
`db3332ce75676389b79cf3603d81cb231cb7c19c`	`db69c7c930fd5dc5097847979a965fdea4171d5b`	`dba5fef27b53ff479a4d7046cd1f22710081a16c`
`de9d152010819c8fb5cb611a4de920399e69cfeb`	`dfd1540c0185e74ec65acfcae1af7ba0da36c774`	`e052ff49190f54e0ffc52f7b3f7b5e7b9e121c4c`
`e3af6d9e3b35e5e04feda3cde96256dd3b099624`	`e4d93fa1b2d0fd26e8b877511ea33badb4628169`	`e5c43abd1c212b2f2a61d5e1cb7821406ca5dc8e`
`e8d09eb2e5857fde39b44aeb48078f5396809026`	`ec7cd90d56e5b73caa9d4eb0472bfee68d716121`	`eec7ece53d47e50940584f4dec684a24a78f42f2`
`f0b23f420659babb3a730b122259440091c53c12`	`f30e9730db0663f87c67a4b9a0cf12ee59b1621a`	`f35e6d2936c0f6dc26bdc68f6d1599cf438a863a`
`f4184e1bb61e19d190555c50fdb9d4591767bf53`	`f47d45eea1c42b066f8537baf72ffa266646bf62`	`f5993e64a18e7494b25a185de9f63a1df961b99a`
`f633fc9fd16dadca2725d3d54aaf13ea1a62174f`	`f6d950a5a8e5ba336f748b66745c6c1f189d3362`	`f8cf33b18e9932d285696fee40a7fee2a87341c2`
`f8dbc552c89bef758e4fcbd9942d06bc0c11db0a`	`f990bf4f05dfa4d86b3e3bc0a54f62e91b83f2c6`	`fa61cf3bebefd88ea9d06007a4b85791aa851c8a`
`fbe8708247fabd8a1bc3963db3911b5e77728669`	`fe6b7d6fa8c2424d14a0d465ab78aaf83db0d07b`	`ff402e64bc42222c8a4ee703123903c2a2117dd9`

Additional source-reported network and file artifacts can support behavioral hunting. Unlike the listed sample hashes and command-and-control destinations, these artifacts are not necessarily malicious in isolation.

Artifact type	Source-reported value	Context
HTTP endpoint	`/gate/handshake`	Establishes an upload session
HTTP endpoint	`/gate/chunk`	Receives encrypted stolen-data archives
HTTP endpoint	`/gate/complete`	Receives the completion notification
HTTP User-Agent	`Microsoft-CryptoAPI/10.0`	Used by the latest analyzed samples
HTTP headers	`X-Build-ID`, `X-Gate-Token`, `X-Session`, `X-HWID`, `X-KEX`, `X-Chunk`, `X-Chunk-Index`	Communication and upload metadata
Upload category	`aisessions`	Identifies collected AI application data
Configuration section	`.stgcfg`	Stores encrypted malware configuration
Configuration marker	`STGC`	Identifies the encrypted configuration structure
Component directory	`C:\Microsoft\Vault`	Location beneath which the clipper component is dropped
YARA strings	`AKGRES`, `AISessions/`, `aokigahara`, `kamidere`	Strings included in Check Point’s detection rule

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post New Aokigahara Malware Targets ChatGPT, Claude, Codex, and Cursor Login Credentials appeared first on Cyber Security News.