Check Point Research said on 23 October 2026 that it has spotted a new infostealer in the wild. An infostealer is a program that steals saved logins and files. This one is called Aokigahara. Check Point said an earlier version may have gone by the names Kamidere or Stygian. It takes data from browsers, crypto wallets, VPN clients and password managers. It also goes after Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI. It collects AWS, Azure and Google Cloud credential files, Git credentials and SSH private keys too.
Check Point said the malware looks to be under active development, because its network identifier changed between versions. It noted that not every file the malware targets holds a secret. Its analysis does not confirm how the operators make money from the stolen data. Account resale, use of paid services and extortion are listed as possible routes, not observed ones. Check Point gave no victim count, no infection method and no named operators.
Check Point said valid tokens or keys could let attackers reach AI services or cloud accounts without a password. It said AI app credentials and session data should be treated as sensitive, like browser sessions, cloud credentials and developer keys. Teams whose developers use these tools should put those files on the same protection list as cloud keys.