# Aokigahara Infostealer Targets ChatGPT, Claude, Codex, and Cursor Login Credentials

> Aokigahara (also tracked as Aoki; earlier versions possibly Kamidere or Stygian) is a Windows infostealer that harvests authentication files, session tokens and configuration data from AI applications and developer tools, alongside browser credentials, SSH keys, cloud configs, crypto wallets, messaging, VPN and email data. Check Point Research published its analysis and IOCs on 2026-10-23.

- **Published:** 2026-10-27T05:47:11Z
- **Last reviewed:** 2026-10-27T05:47:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4514
- **ID:** TL-2026-4514
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Aokigahara is a modular Windows infostealer analysed by Check Point Research in the report 'Infostealer riding the AI Train' (2026-10-23). Press coverage states the family was first observed earlier in 2026 and previously lacked collection routines for AI applications; recent samples add an 'aisessions' module that collects credential and session files for Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, Codeium, JetBrains AI Assistant, Amazon Q and Kiro. Check Point notes that an earlier version may have been known as Kamidere or Stygian; the binary carries 'STGC' config markers and 'kamidere' strings that support this lineage.

The stealer is built from handler modules: sysinfo, browsers (Chromium and Firefox, 30+ variants), wallets (MetaMask, Phantom and others), discord/telegram, steam/gaming (Roblox, Epic Games, Battle.net), passman (KeePass, Bitwarden, 1Password, Dashlane), vpn (NordVPN, ProtonVPN, Surfshark), ftp (FileZilla, WinSCP, CoreFTP), outlook/thunderbird, aisessions, ide (Git credentials, SSH keys, AWS/Azure/Google Cloud configs), screenshot, clipboard and filegraber (Desktop/Documents/Downloads). AI targets include .claude\credentials.json, .claude.json, the OpenAI.ChatGPT-Desktop package LocalCache, Cursor/Windsurf/VS Code globalStorage state.vscdb, .copilot\config.json and hosts.json, .codex\auth.json, .codeium\config.json, gemini-cli-workspace-token.json and master key, JetBrains AIAssistantQuotaManager2.xml, amazon-q\data.sqlite3 and .aws\credentials, config and sso\cache. Check Point assesses that stolen AI credentials can be monetised through unauthorised use of paid AI services, account resale and data extortion over private conversations or proprietary code.

The malware stores its configuration in a '.stgcfg' PE section (magic 'STGC', AES-256-CBC, 16-byte IV, key derived from a seed via an FNV-style routine, decryption routine protected by control-flow flattening). The config holds the base URL, X25519 server public key, build ID, gate token, module bitmask, language/analysis check flags, a TLS certificate-pinning SHA-256 and up to three fallback URLs. When enabled, a language check terminates execution on Russian, Ukrainian, Belarusian, Tajik, Armenian, Azerbaijani, Georgian, Kazakh, Kyrgyz, Turkmen or Uzbek keyboard layout/UI language. Anti-analysis covers PEB, debug port/object and DR0-DR3 hardware breakpoint checks, CPUID hypervisor, VM registry and SMBIOS fingerprints, process-count, suspicious-username (sandbox, malware, virus, sample, test, admin, John Doe, WDAGUtilityAccount) and cursor-movement checks.

Exfiltration uses three HTTP endpoints: /gate/handshake (client's raw 32-byte X25519 public key), /gate/chunk (AES-256-GCM encrypted ZIP archives; nonce = 4-byte LE chunk index + 8 random bytes; AES key = SHA-256 of the X25519 shared secret plus the string 'aokigahara'; headers X-Chunk, X-Chunk-Index, X-Build-ID, X-HWID, X-Gate-Token, X-Session, X-KEX: x25519) and /gate/complete (8-byte 'COMPLETE' marker). The User-Agent is 'Microsoft-CryptoAPI/10.0'. Older samples sent unencrypted HTTP to an IP on port 8080. The malware does not execute remote commands; it collects and sends. A clipper component is installed under C:\Microsoft\Vault, and staging databases are named kmd_w_{int}_{int}.db. The delivery vector, persistence and loader stages are not documented in the available sources, and no operator attribution has been made. Severity is an analyst assessment; no CVE or CVSS applies.

## MITRE ATT&CK

- T1005 Data from Local System
- T1113 Screen Capture
- T1560 Archive Collected Data
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1497 Virtualization/Sandbox Evasion
- T1622 Debugger Evasion
- T1480 Execution Guardrails
- T1140 Deobfuscate/Decode Files or Information
- T1082 System Information Discovery
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1528 Steal Application Access Token
- T1555.005 Password Managers
- T1555.004 Windows Credential Manager
- T1552.004 Private Keys
- T1552.001 Credentials In Files
- T1027 Obfuscated Files or Information
- T1057 Process Discovery
- T1518 Software Discovery
- T1071.001 Web Protocols
- T1008 Fallback Channels
- T1001.003 Protocol or Service Impersonation

## Sources

- [Infostealer riding the AI Train (Check Point Research)](https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/)
- [New Aokigahara Malware Targets ChatGPT, Claude, Codex, and Cursor Login Credentials](https://cybersecuritynews.com/aokigahara-malware/)
- [Aoki Infostealer Targets AI (GBHackers)](https://gbhackers.com/aoki-infostealer-targets-ai/amp/)
- [New Aoki Malware (Cyber Security News)](https://cybersecuritynews.com/new-aoki-malware/amp/)
- [Aoki Infostealer Steals AI Assistant Credentials](https://letsdatascience.com/news/aoki-infostealer-steals-ai-assistant-credentials-07830031)
- [MalwareBazaar sample 73de504b1d7c769d4d6bacd193b06f90aaf2fadb0fb7d2065eb02760d7074fde](https://bazaar.abuse.ch/sample/73de504b1d7c769d4d6bacd193b06f90aaf2fadb0fb7d2065eb02760d7074fde/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4514