Aoki Infostealer Harvests AI Coding Assistant API Keys and Session Tokens
What Happened — The Aoki (aka Aokigahara) infostealer has been updated to locate and exfiltrate credential and session files used by AI coding assistants such as Claude, OpenAI Codex, Cursor, Codeium and Gemini. The stolen API keys and tokens enable attackers to act as legitimate users, potentially abusing cloud services, repositories and CI/CD pipelines.
Why It Matters for Trust & Control Assurance
- Highlights the need for a credential‑management control objective that enforces strict protection, rotation and monitoring of privileged API keys.
- Demonstrates why continuous evidence of access‑control enforcement (e.g., MFA, vaulting, usage analytics) is essential for audit readiness.
- Aligns with Verisq’s Access Controls capability, which helps organizations collect and present defensible proof that credential safeguards are in place.
Who Is Affected — Software development firms, cloud‑service providers, and any organization that integrates AI coding assistants into development pipelines.
Recommended Actions
- Deploy a centralized secrets‑management solution and enforce regular API‑key rotation.
- Enable multi‑factor authentication for AI tool access and restrict token scopes to the minimum required.
- Use endpoint detection and response (EDR) to block known infostealer behaviors.
- Implement continuous monitoring of API usage for anomalies and retain logs as audit evidence.
Technical Notes
- Malware type: credential‑stealing infostealer (no backdoor command list).
- Targets:
.claude.json, Claude desktop cookies, ChatGPT cookies,config.tomland.envfiles for Codex, plus tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant, Kiro, and AWS credentials. - Also harvests browser data, crypto‑wallet extensions, password‑manager entries, messaging apps and VPN/FTP client credentials.
Source: Broadcom Symantec Blog – Aoki Infostealer Targets AI Coding Assistant Credentials