# Aoki (Aokigahara) Infostealer Targets AI Coding Assistant Credentials

> Symantec and Carbon Black report Aoki (aka Aokigahara, detected as Infostealer.Aoki), an infostealer first observed in 2026 whose newer variants steal API keys, OAuth tokens and session credentials from AI coding assistants alongside browser, crypto wallet, password manager, messaging, gaming and VPN/FTP client data. It has no backdoor command set; it collects available data and sends it to a /gate C&C endpoint.

- **Published:** 2026-10-15T10:24:57Z
- **Last reviewed:** 2026-10-15T10:24:57Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3606
- **ID:** TL-2026-3606
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Aoki (also tracked as Aokigahara; Symantec detection Infostealer.Aoki) is a relatively new information stealer first observed in 2026. Recent variants extend the traditional stealer feature set to AI coding assistant credentials. Per Symantec, targeted assistants include Claude (the .claude.json file and Claude desktop cookies), OpenAI Codex, Cursor, Codeium, Google Gemini, JetBrains AI Assistant, Kiro and GitHub Copilot. Stolen API keys and OAuth/session tokens let an attacker act under a legitimate user's identity and API quota and potentially bypass security controls.

Beyond AI tooling, the stealer harvests cookies, autofill data, credit card data, history and Google tokens from Chrome, Edge, Brave, Opera, Vivaldi, Firefox, Waterfox, LibreWolf and 30+ further browsers; 40+ cryptocurrency wallet browser extensions (MetaMask, Phantom, Coinbase, Binance, Trust Wallet and others) and desktop wallets (Exodus, Atomic, Electrum, Bitcoin Core, Monero and others); files whose names contain wallet-seed keywords (mnemonic, recovery, privatekey, passphrase, backup, keystore, secret, 12word, 24word, wallet, phrase); Discord clients and mods, Telegram-related data (tdata, 64Gram, Kotatogram); gaming platforms (Steam, Roblox, Epic Games, Battle.net, Riot, Minecraft, GOG, Origin, Ubisoft); AWS credentials; Outlook passwords from the registry; Thunderbird profiles; FileZilla, WinSCP; OpenVPN, NordVPN, ProtonVPN; and password managers (KeePass, Bitwarden, 1Password, Dashlane, RoboForm, NordPass). The malware also gathers data on installed security products.

Command and control: newer samples use HTTPS to domain-based C&C (dobeqnesmot.cc, hjazfioe.surf, neihite.cc) and post collected data to a /gate endpoint; older variants used unencrypted HTTP to raw IP addresses on port 8080. The malware has no backdoor command list. The name derives from a decryption string referencing Aokigahara, a forest in Japan; this is not an attribution indicator. The source does not state the delivery/infection chain or any persistence mechanism, and no links to existing malware families or threat actors are established. A BeaconBeagle domain query for dobeqnesmot.cc returned no matches at research time. Severity is analyst-assigned (no CVE/CVSS).

## MITRE ATT&CK

- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1555.005 Credentials from Password Stores: Password Managers
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.002 Unsecured Credentials: Credentials in Registry
- T1518.001 Software Discovery: Security Software Discovery
- T1005 Data from Local System
- T1119 Automated Collection
- T1071.001 Application Layer Protocol: Web Protocols
- T1583.001 Acquire Infrastructure: Domains

## Sources

- [Aoki: Infostealer Targets AI Coding Assistant Credentials (Symantec / Carbon Black)](https://www.security.com/threat-intelligence/aoki-infostealer-ai-targeting)
- [AI Coding Assistant Credential Storage: Paths & Risks (Netwrix)](https://netwrix.com/en/resources/blog/ai-coding-assistant-credential-storage-risks/)
- [How Infostealers Target AI Agent Credentials (SOCRadar)](https://socradar.io/blog/ai-agent-credential-stealer-log-source-code/)
- [SimpleHelp Auth Bypass Deploys AI-Targeting Djinn Stealer (CSA Labs, related stealer)](https://labs.cloudsecurityalliance.org/research/csa-research-note-simplehelp-djinn-stealer-20260630-csa-styl/)
- [Fake Claude Code malware shows how AI developer trust becomes attack surface (NHIMG)](https://nhimg.org/articles/fake-claude-code-malware-shows-how-ai-developer-trust-becomes-attack-surface/)
- [AI coding agent tokens and infostealers (Engenious)](https://engenious.io/en/blog/ai-coding-agent-tokens-infostealers)
- [BeaconBeagle config search for dobeqnesmot.cc (no matches)](https://beaconbeagle.com/api/v1/configs/search?domain=dobeqnesmot.cc)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3606