New Aoki Infostealer Targets AI Coding Assistant Credentials

New versions of the Aoki infostealer are targeting credential and session files used by popular AI coding assistants, a new report by Symantec has warned.

This represents a significant development from to earlier versions of Aoki, which focused on browser, cryptocurrency wallet and password manager data, and did not target AI-related files.

Now, the stealer is also able to access API keys and tokens from a number of AI coding assistants, including Anthropic’s Claude, OpenAI's Codex, SpaceX’s Cursor and Google’s Gemini.

The Symantec researchers said that this information can allow a threat actor to carry out malicious activity under a legitimate developer's identity and API quota, bypassing safeguards that assume requests originate from a trusted user.

In addition, the tokens can expose connected repositories, cloud services and continuous integration and continuous delivery (CI/CD) pipelines linked to that account.

Aoki Targets ChatGPT, Claude and GitHub Copilot Credentials

The report, published on October 15, noted that Aoki is a relatively new and sparsely documented infostealer, first observed earlier in 2026.

The ability to steal AI-related files is recent and appears to be expanding, the researchers noted. The newest version of the stealer found by the Symantec’s Threat Hunter Team targeted .claude.json, Claude desktop cookies, ChatGPT cookies, and the Codex config.toml and .env files.

In addition, it stole tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro, along with Amazon Web Services (AWS) credentials.

“Aoki is a highly capable and multi-functional infostealer whose capabilities still appear to be in active development,” Symantec added.

AI Credentials Increasingly Valuable to Hackers

The researchers said Aoki’s development suggests that AI credentials are now considered just as valuable as payment card data and cryptocurrency wallets by threat actors.

“Like card data, a stolen AI key can be cashed in directly, either through resale or by running up usage on the victim's account, a practice sometimes called LLMjacking. Unlike card data, it can also give an attacker a route into the developer's wider environment,” they explained.

Symantec emphasized that it does not know which threat group may be behind the Aoki infostealer and there are no indications it has links to any existing malware family.

However, the rest of the stealer’s target list, which includes a focus on cryptocurrency related wallets and extensions, indicates that the attackers are financially-motivated.