GoKawiilNew 'Aokigahara' Infostealer Targets Credentials for AI Tools Like ChatGPT, Cursor, Copilot
Check Point Software researchers identified a new Windows-based infostealer named Aokigahara that, alongside typical data theft from browsers, VPN clients, crypto wallets and password managers, specifically harvests authentication files, session data and configuration files from AI tools including Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI. Check Point said this focus on AI and developer tooling sets Aokigahara apart from most stealers currently seen in the wild.
GoKawiil's interpretation of the reporting above, not reported fact.
By targeting AI assistants and developer environments rather than just personal and financial accounts, the malware could let attackers resell or reuse paid AI service access and pivot into cloud and source-code repositories via stolen SSH keys or cloud credentials, according to Check Point. This suggests cybercriminals are increasingly viewing AI tool access and developer credentials as valuable commodities in their own right, potentially exposing enterprises to deeper supply-chain and cloud compromise.
- Aokigahara is a new infostealer that targets AI tools such as ChatGPT, Claude, Cursor and GitHub Copilot alongside traditional targets.
- It collects authentication, session and configuration data that could enable resale or unauthorized use of paid AI services.
- Stolen developer credentials, including SSH keys and cloud configs, could expose enterprise cloud and code repositories to further attacks.
YubiKey 5 NFC Security Key — With infostealers like Aokigahara now harvesting session tokens and credentials from AI dev tools and password managers, hardware-based authentication is a smart layer of defense. A YubiKey adds phishing-resistant multi-factor authentication to your accounts so stolen passwords or session files alone can't be used to break in. It's a practical step developers can take to protect their GitHub, cloud, and AI assistant accounts from exactly this kind of attack.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Elizabeth Montalbano, 2026-10-27
Published there as: “'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.