Threat reportMalwareTL-2026-3606
Aoki (Aokigahara) Infostealer Targets AI Coding Assistant Credentials
Aoki (Aokigahara) Infostealer Targets AI Coding Assistant (TL-2026-3606), also tracked as Aokigahara, is a high-severity malware campaign, first published 2026-10-15. It has no confirmed attribution, affects Microsoft Windows endpoints (user data of targeted applications), maps to 11 MITRE ATT&CK techniques (T1005, T1071.001, T1119), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-3606
- Threat ID
- TL-2026-3606
- Also known as
- Aokigahara, Infostealer.Aoki
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, finance, gaming, cryptocurrency
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Aoki (Aokigahara) Infostealer Targets AI Coding Assistant
Malware and tooling: Aoki, Infostealer.Aoki
How Aoki (Aokigahara) Infostealer Targets AI Coding Assistant works
Symantec and Carbon Black report Aoki (aka Aokigahara, detected as Infostealer.Aoki), an infostealer first observed in 2026 whose newer variants steal API keys, OAuth tokens and session credentials from AI coding assistants alongside browser, crypto wallet, password manager, messaging, gaming and VPN/FTP client data. It has no backdoor command set; it collects available data and sends it to a /gate C&C endpoint.
Aoki (also tracked as Aokigahara; Symantec detection Infostealer.Aoki) is a relatively new information stealer first observed in 2026. Recent variants extend the traditional stealer feature set to AI coding assistant credentials. Per Symantec, targeted assistants include Claude (the .claude.json file and Claude desktop cookies), OpenAI Codex, Cursor, Codeium, Google Gemini, JetBrains AI Assistant, Kiro and GitHub Copilot. Stolen API keys and OAuth/session tokens let an attacker act under a legitimate user's identity and API quota and potentially bypass security controls.
Beyond AI tooling, the stealer harvests cookies, autofill data, credit card data, history and Google tokens from Chrome, Edge, Brave, Opera, Vivaldi, Firefox, Waterfox, LibreWolf and 30+ further browsers; 40+ cryptocurrency wallet browser extensions (MetaMask, Phantom, Coinbase, Binance, Trust Wallet and others) and desktop wallets (Exodus, Atomic, Electrum, Bitcoin Core, Monero and others); files whose names contain wallet-seed keywords (mnemonic, recovery, privatekey, passphrase, backup, keystore, secret, 12word, 24word, wallet, phrase); Discord clients and mods, Telegram-related data (tdata, 64Gram, Kotatogram); gaming platforms (Steam, Roblox, Epic Games, Battle.net, Riot, Minecraft, GOG, Origin, Ubisoft); AWS credentials; Outlook passwords from the registry; Thunderbird profiles; FileZilla, WinSCP; OpenVPN, NordVPN, ProtonVPN; and password managers (KeePass, Bitwarden, 1Password, Dashlane, RoboForm, NordPass). The malware also gathers data on installed security products.
Command and control: newer samples use HTTPS to domain-based C&C (dobeqnesmot.cc, hjazfioe.surf, neihite.cc) and post collected data to a /gate endpoint; older variants used unencrypted HTTP to raw IP addresses on port 8080. The malware has no backdoor command list. The name derives from a decryption string referencing Aokigahara, a forest in Japan; this is not an attribution indicator. The source does not state the delivery/infection chain or any persistence mechanism, and no links to existing malware families or threat actors are established. A BeaconBeagle domain query for dobeqnesmot.cc returned no matches at research time. Severity is analyst-assigned (no CVE/CVSS).
MITRE ATT&CK techniques used in TL-2026-3606
Collection
T1005 Data from Local System; T1119 Automated Collection
Command and Control
T1071.001 Application Layer Protocol: Web Protocols
Discovery
T1518.001 Software Discovery: Security Software Discovery
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1552.002 Unsecured Credentials: Credentials in Registry; T1555.003 Credentials from Password Stores: Credentials from Web Browsers; T1555.005 Credentials from Password Stores: Password Managers
Resource Development
Affected products and versions in Aoki (Aokigahara) Infostealer Targets AI Coding Assistant
- Microsoft — Windows endpoints (user data of targeted applications)
Vulnerable versions: Not version-specific - Anthropic / OpenAI / Cursor / Codeium / Google / JetBrains / Kiro / GitHub — AI coding assistant credentials and session data (Claude, Codex, Cursor, Codeium, Gemini, JetBrains AI Assistant, Kiro, GitHub Copilot)
Vulnerable versions: Credential theft from infected hosts; not a product vulnerability
Remediation for Aoki (Aokigahara) Infostealer Targets AI Coding Assistant
Immediate actions
- Block dobeqnesmot.cc, hjazfioe.surf and neihite.cc (and /gate URLs) at DNS, proxy and egress firewall
- Hunt endpoints for the 17 listed SHA-256 hashes and Symantec detection Infostealer.Aoki
- On any confirmed infection, revoke and rotate AI assistant API keys, OAuth tokens and session cookies (Claude, Codex, Cursor, Codeium, Gemini, JetBrains AI, Kiro, Copilot), plus cloud (AWS), browser-stored, VPN/FTP and password manager credentials
- Review AI provider usage and billing logs for unexpected API quota consumption
Workarounds
- Sign out of AI assistant sessions on suspected compromised hosts and revoke active sessions from the provider console
- Avoid storing secrets in plaintext config files on developer endpoints
Longer-term hardening
- Inventory where AI coding assistant credentials are stored on developer endpoints and prefer short-lived, scoped tokens
- Deploy EDR with infostealer behavioral detection on developer workstations, including unmanaged/BYOD devices used with AI tools
- Alert on non-browser processes reading browser profile stores, wallet directories and AI assistant config files
- Enforce phishing-resistant MFA and device-bound sessions to limit stolen-cookie reuse
Timeline of Aoki (Aokigahara) Infostealer Targets AI Coding Assistant
- Netwrix publishes research on predictable plaintext credential storage paths of AI coding assistants (e.g. Claude Code, Continue.dev, MCP configs), describing malware credential theft as an attack scenario (context; not Aoki-specific)
- CSA Labs research note on Djinn Stealer, another infostealer targeting AI tooling (context; not Aoki-specific)
- SOCRadar publishes analysis of infostealers harvesting AI agent credentials from developer machines (context; does not mention Aoki)
- BeaconBeagle config search for dobeqnesmot.cc returns no matches
- Symantec detection Infostealer.Aoki listed alongside 17 SHA-256 hashes and three C&C domains with /gate endpoints
- Symantec and Carbon Black Threat Hunter Team publish the Aoki infostealer report; malware described as first observed in 2026 (exact first-seen date not stated) with newer variants targeting AI coding assistant credentials
Sources cited for Aoki (Aokigahara) Infostealer Targets AI Coding Assistant
- Aoki: Infostealer Targets AI Coding Assistant Credentials (Symantec / Carbon Black)
- AI Coding Assistant Credential Storage: Paths & Risks (Netwrix)
- How Infostealers Target AI Agent Credentials (SOCRadar)
- SimpleHelp Auth Bypass Deploys AI-Targeting Djinn Stealer (CSA Labs, related stealer)
- Fake Claude Code malware shows how AI developer trust becomes attack surface (NHIMG)
- AI coding agent tokens and infostealers (Engenious)
- BeaconBeagle config search for dobeqnesmot.cc (no matches)
Detection coverage for TL-2026-3606
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3606 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.