- Check Point Research reports a new infostealer, Aokigahara, whose collection routines go after session and credential files for Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI.
- It also targets Git credentials, SSH keys and cloud credential files. If stolen tokens are valid and usable, they could expose AI accounts and cloud environments.
- The source gives no victim count, does not say how the malware spreads, and does not confirm how operators profit. Ask whether your security program lists AI sessions as sensitive assets.
Your AI assistant now holds keys worth stealing
Picture a developer's laptop as a filing cabinet. It holds source code and cloud logins. It may also hold the records that keep AI tools signed in. Check Point Research has described a piece of malware that goes after all of these.
The malware is called Aokigahara. Check Point describes it as newly observed and spotted in the wild. The researchers say an earlier version may have gone by the names Kamidere or Stygian.
Much of its behaviour is familiar. It targets browser passwords and cookies, cryptocurrency wallet data, screenshots and clipboard contents. Its list of targets also covers messaging apps, password managers, VPN clients and email programs.
The distinctive part is a routine the researchers call the aisessions handler. It is aimed at AI applications and coding tools. Seven are named: Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI. The same handler also targets AWS credentials and single sign-on data.
How the theft works
An infostealer does not break into your AI account. It collects the files that show you are already signed in. Depending on the application, those files may hold tokens, credentials, session data or settings.
A session token works like a keycard that is already activated. Whoever holds a valid one can walk in without a password. Check Point cautions that not every targeted file necessarily contains a secret.
The malware keeps its settings in an encrypted block inside the program. According to Check Point, those settings include the address of the attackers' server and a bitmask, a set of on-off switches, that decides which collection modules run. Every module stays inside the file even when it is switched off.
Stolen data leaves in encrypted ZIP archives, one per module, sent to a path called /gate/chunk. A label on each upload names the type of data, such as browsers or aisessions. A final message to /gate/complete signals that the upload is done.
The malware also tries to avoid study. It stops if the system uses certain languages. It checks for debuggers, virtual machines and sandboxes. Check Point sees signs of ongoing work: the User-Agent string it sends to the server differs between versions.
What an attacker could do with it
The researchers list several possibilities. Valid credentials could expose private conversations and development data. They could allow unauthorized use of paid services. They could also be resold as access to compromised accounts.
The collection scope goes beyond AI tools. Check Point says it includes Git credential files, SSH private keys, and credential and configuration files for AWS, Azure and Google Cloud.
One caveat matters. Check Point states that its analysis does not confirm how the operators make money from the stolen data. The uses above are what the collection routines make possible, not observed crimes. The material we reviewed also gives no victim count and does not say how the malware spreads.
Check Point adds a further risk. People share sensitive business information and proprietary code with AI services. If stolen access reveals conversation histories or uploaded files, attackers could threaten to publish them and demand payment.
The idea behind the malware
This is our interpretation, not a finding from the report. A chat history can hold a contract draft, a code review or an architecture decision. If so, the login that opens it deserves the care you give a cloud admin key.
Does your security program list AI sessions as sensitive assets? Many programs focus on the password, and the token left on the laptop can be an afterthought. Check Point's key finding points the other way: AI application credentials and session data belong in the same sensitive category as browser sessions, cloud credentials and developer keys.
Questions to put to your team
First, ask which AI applications and coding assistants run on company laptops, and who approved them. You cannot protect sign-ins you have not listed.
Second, ask whether you can revoke AI sessions and API keys centrally. If you cannot, find out how long a stolen token would stay valid.
Third, ask what happens after an infostealer is found on a machine. A good plan resets browser passwords, and it also rotates cloud keys, SSH keys, Git credentials and AI sessions.
Fourth, ask where developers keep keys. Credentials in local configuration files are exactly what this malware targets.
The report is about one stealer, so it shows a direction rather than a trend. Check Point says the targeting reflects a broader shift in what attackers "may consider valuable". This stealer treats the AI assistant as part of the vault, and defenders should do the same.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Check Point Research.
