Threat reportMalwareTL-2026-4514
Aokigahara Infostealer Targets ChatGPT, Claude, Codex, and Cursor Login Credentials
Aokigahara Infostealer Targets ChatGPT, Claude, Codex, and (TL-2026-4514), also tracked as Aoki, is a high-severity malware campaign, first published 2026-10-27. It has no confirmed attribution, affects Multiple Windows endpoints with AI/developer tools (ChatGPT Desktop, maps to 25 MITRE ATT&CK techniques (T1001.003, T1005, T1008), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 25MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-4514
- Threat ID
- TL-2026-4514
- Also known as
- Aoki, Kamidere, Stygian
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, finance, cryptocurrency, gaming
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Aokigahara Infostealer Targets ChatGPT, Claude, Codex, and
Malware and tooling: Aokigahara, Clipper, Kamidere, Stygian
How Aokigahara Infostealer Targets ChatGPT, Claude, Codex, and works
Aokigahara (also tracked as Aoki; earlier versions possibly Kamidere or Stygian) is a Windows infostealer that harvests authentication files, session tokens and configuration data from AI applications and developer tools, alongside browser credentials, SSH keys, cloud configs, crypto wallets, messaging, VPN and email data. Check Point Research published its analysis and IOCs on 2026-10-23.
Aokigahara is a modular Windows infostealer analysed by Check Point Research in the report 'Infostealer riding the AI Train' (2026-10-23). Press coverage states the family was first observed earlier in 2026 and previously lacked collection routines for AI applications; recent samples add an 'aisessions' module that collects credential and session files for Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, Codeium, JetBrains AI Assistant, Amazon Q and Kiro. Check Point notes that an earlier version may have been known as Kamidere or Stygian; the binary carries 'STGC' config markers and 'kamidere' strings that support this lineage.
The stealer is built from handler modules: sysinfo, browsers (Chromium and Firefox, 30+ variants), wallets (MetaMask, Phantom and others), discord/telegram, steam/gaming (Roblox, Epic Games, Battle.net), passman (KeePass, Bitwarden, 1Password, Dashlane), vpn (NordVPN, ProtonVPN, Surfshark), ftp (FileZilla, WinSCP, CoreFTP), outlook/thunderbird, aisessions, ide (Git credentials, SSH keys, AWS/Azure/Google Cloud configs), screenshot, clipboard and filegraber (Desktop/Documents/Downloads). AI targets include .claude\credentials.json, .claude.json, the OpenAI.ChatGPT-Desktop package LocalCache, Cursor/Windsurf/VS Code globalStorage state.vscdb, .copilot\config.json and hosts.json, .codex\auth.json, .codeium\config.json, gemini-cli-workspace-token.json and master key, JetBrains AIAssistantQuotaManager2.xml, amazon-q\data.sqlite3 and .aws\credentials, config and sso\cache. Check Point assesses that stolen AI credentials can be monetised through unauthorised use of paid AI services, account resale and data extortion over private conversations or proprietary code.
The malware stores its configuration in a '.stgcfg' PE section (magic 'STGC', AES-256-CBC, 16-byte IV, key derived from a seed via an FNV-style routine, decryption routine protected by control-flow flattening). The config holds the base URL, X25519 server public key, build ID, gate token, module bitmask, language/analysis check flags, a TLS certificate-pinning SHA-256 and up to three fallback URLs. When enabled, a language check terminates execution on Russian, Ukrainian, Belarusian, Tajik, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Turkmen or Uzbek keyboard layout/UI language. Anti-analysis covers PEB, debug port/object and DR0-DR3 hardware breakpoint checks, CPUID hypervisor, VM registry and SMBIOS fingerprints, process-count, suspicious-username (sandbox, malware, virus, sample, test, admin, John Doe, WDAGUtilityAccount) and cursor-movement checks.
Exfiltration uses three HTTP endpoints: /gate/handshake (client's raw 32-byte X25519 public key), /gate/chunk (AES-256-GCM encrypted ZIP archives; nonce = 4-byte LE chunk index + 8 random bytes; AES key = SHA-256 of the X25519 shared secret plus the string 'aokigahara'; headers X-Chunk, X-Chunk-Index, X-Build-ID, X-HWID, X-Gate-Token, X-Session, X-KEX: x25519) and /gate/complete (8-byte 'COMPLETE' marker). The User-Agent is 'Microsoft-CryptoAPI/10.0'. Older samples sent unencrypted HTTP to an IP on port 8080. The malware does not execute remote commands; it collects and sends. A clipper component is installed under C:\Microsoft\Vault, and staging databases are named kmd_w_{int}_{int}.db. The delivery vector, persistence and loader stages are not documented in the available sources, and no operator attribution has been made. Severity is an analyst assessment; no CVE or CVSS applies.
MITRE ATT&CK techniques used in TL-2026-4514
Command and Control
T1001.003 Protocol or Service Impersonation; T1008 Fallback Channels; T1071 Application Layer Protocol; T1071.001 Web Protocols; T1573 Encrypted Channel
Collection
T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1518 Software Discovery
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1552.001 Credentials In Files; T1552.004 Private Keys; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers; T1555.004 Windows Credential Manager; T1555.005 Password Managers
Affected products and versions in Aokigahara Infostealer Targets ChatGPT, Claude, Codex, and
- Multiple — Windows endpoints with AI/developer tools (ChatGPT Desktop, Claude Code/Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, JetBrains AI Assistant, Amazon Q, Kiro, VS Code)
Vulnerable versions: Credential and session files stored locally on Windows hosts
Remediation for Aokigahara Infostealer Targets ChatGPT, Claude, Codex, and
Immediate actions
- Isolate suspected infected hosts and use a clean system to revoke AI sessions and tokens (ChatGPT, Claude, Codex, Cursor, Windsurf, Copilot, Gemini, JetBrains AI, Amazon Q, Kiro)
- Rotate exposed API keys, SSH keys, Git/PAT tokens and AWS/Azure/GCP credentials found on affected endpoints
- Review AI account activity and determine whether sensitive conversations or uploaded files were accessible
- Block the published C2 IP 2.26.252.48 and domains at DNS/proxy/firewall
- Hunt for the clipper under C:\Microsoft\Vault, kmd_w_*.db files and \\.\pipe\akg_* named pipes
Workarounds
- Restrict developer workstation egress to approved destinations
- Remove stored long-lived credentials from plaintext config files where possible
Longer-term hardening
- Deploy EDR with detection for non-browser processes reading AI tool credential stores (.claude, .codex, .aws, state.vscdb)
- Use short-lived, scoped tokens and hardware-bound or SSO-managed credentials for developer tooling
- Review connected cloud and repository accounts after any infostealer exposure; password resets alone are insufficient
- Alert on /gate/handshake, /gate/chunk and /gate/complete HTTP patterns and the 'Microsoft-CryptoAPI/10.0' User-Agent from non-CryptoAPI processes
Weaknesses (CWE) in Aokigahara Infostealer Targets ChatGPT, Claude, Codex, and
Timeline of Aokigahara Infostealer Targets ChatGPT, Claude, Codex, and
- Aoki/Aokigahara first observed earlier in 2026 (approximate date; press reports state early 2026), initially without AI-application collection routines
- Report documents the aisessions and ide handler modules, the .stgcfg encrypted config with TLS pinning and three fallback URLs, and the X25519/AES-256-GCM chunked exfiltration protocol
- Check Point's IOC table lists 142 Aokigahara sample SHA-1 hashes plus a separate clipper component (8d6c86e0af7807f9b5baf15e9f076bb81e012515), indicating a large, actively rebuilt sample corpus
- Check Point assesses that an earlier version of the family may have been known as Kamidere or Stygian; older samples used unencrypted HTTP to an IP on port 8080 while current ones use the encrypted /gate protocol
- Check Point releases IOCs (C2 IP 2.26.252.48:8080, six domains plus gate subdomain, SHA-1 hashes) and a YARA rule for Aokigahara
- Check Point Research publishes 'Infostealer riding the AI Train' documenting the aisessions module targeting Claude, ChatGPT, Codex, Cursor and other AI/developer tools
- Cyber Security News and other outlets report Aokigahara targeting ChatGPT, Claude, Codex and Cursor login credentials
- Press coverage notes the operators' monetisation methods remain unconfirmed and no attribution has been made; no delivery vector is documented
Sources cited for Aokigahara Infostealer Targets ChatGPT, Claude, Codex, and
- Infostealer riding the AI Train (Check Point Research)
- New Aokigahara Malware Targets ChatGPT, Claude, Codex, and Cursor Login Credentials
- Aoki Infostealer Targets AI (GBHackers)
- New Aoki Malware (Cyber Security News)
- Aoki Infostealer Steals AI Assistant Credentials
- MalwareBazaar sample 73de504b1d7c769d4d6bacd193b06f90aaf2fadb0fb7d2065eb02760d7074fde
Detection coverage for TL-2026-4514
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4514 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.