Aoki Infostealer: Your Coding Agent's Keys Are on the List

Aoki Infostealer: Your Coding Agent's Keys Are on the List

The Aoki infostealer added AI coding assistants to its collection list: a dozen credential files across Claude, Codex, Copilot, Cursor, Gemini, JetBrains and Kiro, per Symantec's Threat Hunter team. Stealers work from known paths, and your agent's credentials sit at predictable ones. The full list, what the tokens expose, and the endpoint audit.

What Aoki takes, file by file

The newest samples Symantec analysed target .claude.json, Claude desktop cookies, ChatGPT cookies, and Codex config.toml and .env files. They also take tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, plus AWS credentials. Roundups of the report add two paths worth naming. One is ~/.claude/.credentials.json, holding an OAuth access token and a long-lived refresh token. The other is ~/.codex/auth.json, the file OpenAI's own documentation tells you to treat like a password.

The Cursor grab is larger than a token. Its local state database caches chat logs and code snippets. Your prompts and your proprietary code leave the machine together with the credential that can spend your quota.

From wallets to agents

Aoki is also tracked as Aokigahara, after a decryption string in the binary. It was first observed earlier in 2026 and remains sparsely documented; Symantec analysed 17 file samples. Older builds ignored developer tools completely, and the AI capability is a recent addition that Symantec describes as still in active development.

The older appetite did not shrink. The same samples still loot the classics. They take data from 41 web browsers, 67 wallet extensions, 21 desktop cryptocurrency apps, seven password managers, VPN and FTP clients, and Telegram and Discord sessions. They also search filenames for the words mnemonic, private_key, passphrase, keystore and 24word. AI credentials joined the haul, per Symantec, because they are now worth as much as payment card data.

What a stolen agent token exposes

Symantec's answer is blunt: activity under a legitimate user's identity and API quota, bypassing safeguards that assume requests come from a trusted user. The tokens can also expose connected repositories, cloud services and CI/CD pipelines linked to the account.

The .claude.json case is sharper still, because that file holds MCP server configurations: a map of every tool your agent can touch, sometimes with credentials attached. That is precisely the pivot surface we traced in our MCP security breakdown, now readable by whoever buys the log file.

Where the data goes

Aoki carries no backdoor command list. It collects whatever is available and sends it to a C&C server through a /gate endpoint, according to Symantec. Most newer samples used one domain and two used domains of their own. Older samples posted to an IP address on port 8080, over unencrypted HTTP. Before sending, the malware lists installed security software.

The analysed samples aim at Windows-specific paths, including the registry and Edge WebView2. Symantec classifies the family as Infostealer.Aoki with no attributed group: financially motivated, unlinked, and per Infosecurity Magazine's read of the report, expanding.

The detection gap, in Symantec's own words

Brigid O Gorman, a senior intelligence analyst at Symantec, told ISMG the team did not observe downstream activity. She added that Symantec has no insight into how many victims the stealer reached. Your telemetry is the only telemetry, which is the same posture the platform side keeps landing in.

Our OpenCode breach breakdown is the platform-side sibling: keys stolen from a console instead of a laptop, identical end state, someone else spending under your identity. Aoki industrialises the laptop half.

The endpoint audit

1. Enumerate the paths on every developer machine: .claude.json, ~/.claude/.credentials.json, ~/.codex/auth.json, config.toml, project .env files, Cursor's local state database, JetBrains AI and Kiro credential stores, and AWS credentials. Anything present is stealable.
2. Treat every agent token like a payment credential: isolate the host first, then rotate. That is the order our ChainDrop runbook argues for, because a stealer that already sent does not care when you revoke.
3. Move secrets out of plaintext: OS credential stores where tools support them, environment injection at runtime, short-lived OIDC where providers offer it. OpenAI's docs already call ~/.codex/auth.json a password; store it like one.
4. Alert on the C&C shape: POSTs to /gate endpoints, fresh .cc and .surf domains, plaintext HTTP to port 8080 from developer machines.
5. Shrink what a stolen token reaches. Scope Copilot, Gemini and Kiro tokens, audit the MCP server credentials inside .claude.json, and prune CI/CD connections the agent identity does not need.
6. Run the agents themselves away from the laptop keyring, so endpoint malware finds config but not infrastructure keys. That split is what our guide to running coding agents in isolated cloud environments is built around.

Verdict, and the caveats on this page

Our verdict: Aoki is not clever, it is thorough. It reads a list of paths where the industry decided to store plaintext credentials, and the list keeps growing. The durable fix is making those paths boring: empty, encrypted, or short-lived.

• Symantec observed no downstream activity and cannot size the victim pool, so campaign scale is unknown; that is a limitation of telemetry, not a reassurance.
• The analysed samples are Windows-focused; however, the stolen paths are home-directory files. They exist on macOS and Linux developer machines too, and copycat stealers do not need the Windows code.
• The 17-sample timeline is current to Symantec's 15 October publication, and the capability is in active development, so this page does not stay current for long.
• In our Linux microVM fleet, agent credentials live server side by design, which means we can describe containment and cannot measure endpoint prevalence from here.

FAQ

Which files does the Aoki infostealer steal from AI coding tools?

Per Symantec: .claude.json, Claude desktop cookies, ChatGPT cookies, Codex config.toml and .env files, tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, plus AWS credentials. Roundups add ~/.claude/.credentials.json, ~/.codex/auth.json, and Cursor's local state database, which caches chat logs and code snippets alongside the tokens.

Is Aoki a new infostealer family?

The family is new, first observed earlier in 2026, but the AI targeting is newer. Older builds collected browsers, wallets and password managers while ignoring developer tools entirely. Symantec calls the capability actively in development, and with 17 analysed samples every version boundary on this page is provisional rather than settled.

What should I do if Aoki is found on a developer machine?

Isolate the host, then rotate everything it held: agent tokens, provider API keys, AWS credentials, MCP server secrets from .claude.json, and any CI/CD tokens those identities reach. Symantec observed no downstream activity, but the stealer sends whatever it collects at collection time, so assume exfiltration instead of waiting for proof. Revocation after isolation, never before.

{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "BlogPosting",
      "headline": "Aoki Infostealer: Your Coding Agent's Keys Are on the List",
      "datePublished": "2026-10-21",
      "dateModified": "2026-10-21",
      "author": {"@type": "Organization", "name": "Krova Cloud Engineering"},
      "publisher": {"@type": "Organization", "name": "Krova Cloud"},
      "mainEntityOfPage": "https://krova.cloud/blog/aoki-infostealer-ai-coding-credentials"
    },
    {
      "@type": "FAQPage",
      "mainEntity": [
        {
          "@type": "Question",
          "name": "Which files does the Aoki infostealer steal from AI coding tools?",
          "acceptedAnswer": {"@type": "Answer", "text": "Per Symantec: .claude.json, Claude desktop cookies, ChatGPT cookies, Codex config.toml and .env files, tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, plus AWS credentials. Roundups add ~/.claude/.credentials.json, ~/.codex/auth.json, and Cursor's local state database, which caches chat logs and code snippets alongside the tokens."}
        },
        {
          "@type": "Question",
          "name": "Is Aoki a new infostealer family?",
          "acceptedAnswer": {"@type": "Answer", "text": "The family is new, first observed earlier in 2026, but the AI targeting is newer. Older builds collected browsers, wallets and password managers while ignoring developer tools entirely. Symantec calls the capability actively in development, and with 17 analysed samples every version boundary on this page is provisional rather than settled."}
        },
        {
          "@type": "Question",
          "name": "What should I do if Aoki is found on a developer machine?",
          "acceptedAnswer": {"@type": "Answer", "text": "Isolate the host, then rotate everything it held: agent tokens, provider API keys, AWS credentials, MCP server secrets from .claude.json, and any CI/CD tokens those identities reach. Symantec observed no downstream activity, but the stealer sends whatever it collects at collection time, so assume exfiltration instead of waiting for proof. Revocation after isolation, never before."}
        }
      ]
    }
  ]
}