Aokigahara infostealer goes after AI assistant logins and developer credentials

What Aokigahara collects

CPR describes Aokigahara as an infostealer identified in the wild. Like other information stealers, it targets browser passwords and cookies, cryptocurrency wallets, email applications, password managers, VPNs and other software. What sets it apart, according to the researchers, is its dedicated targeting of AI applications and development tools.

Its collection routines cover Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI and JetBrains AI Assistant, among other tools. Depending on the application, the targeted files may contain authentication tokens, credentials or session information that could potentially give access to the service. CPR notes that not every targeted file necessarily holds an authentication secret.

How the malware works

Once active on a compromised device, Aokigahara uses dedicated collection modules. One AI-focused module searches for authentication, session and configuration files linked to the AI tools. A separate module looks at the wider development environment: Git credential files, SSH-related files that may contain private keys, and credential and configuration files for AWS, Azure and Google Cloud.

The stolen data is packaged into encrypted ZIP archives and uploaded to the attacker's command-and-control server. According to CPR, the malware sorts the information by collection type, including a dedicated category for AI session data, before the upload completes.

CPR stresses that the AI and developer modules operate separately, so the research does not establish that attackers deliberately combine these credentials into a single attack path. Their presence in one infostealer does show how many valuable access points can sit on a single developer machine.

Potential impact and what is not confirmed

If valid credentials or session tokens are stolen, they could potentially let an attacker reach an AI service without entering the user's password. Depending on the service and account, CPR says this could expose private conversations, source code or other sensitive information. It could also allow unauthorized use of paid AI services, or the resale of compromised accounts. The researchers also point to a potential extortion risk if attackers use stolen conversations, files or code as leverage.

These are presented as possible outcomes, not observed ones. CPR has not confirmed that Aokigahara's operators have reused or sold stolen AI credentials, has not confirmed how they monetize the data, and has not observed them carrying out extortion.

Advice for organizations

Check Point argues that AI credentials and authenticated sessions should be handled like other sensitive identity assets. Its recommendations for organizations are:

• Protect AI credentials and sessions: treat tokens, authentication files and application sessions as sensitive credentials.
• Control what is shared with AI: set clear policies on source code, business data and confidential information entered into AI services.
• Secure developer environments: protect Git credentials, SSH keys and cloud credentials stored on developer endpoints.
• Monitor endpoints for infostealers: compromising the device can give attackers several credentials and applications at once.
• Review access after an endpoint compromise: include AI sessions and credentials when investigating credential exposure, alongside browser, cloud and developer credentials.

The broader message from CPR is that protecting what employees type into AI tools is only part of the task. The logins and sessions that give access to those tools also need protection, especially when they live on the same endpoints as source code, Git credentials and cloud access.