Aokigahara stealer harvests AI tool credentials and session tokens
The claim
The authors assert that the Aokigahara infostealer collects authentication data from AI applications and developer tools.
Published as: “Infostealer riding the AI Train”
So what
AI service credentials are now a high-value target for infostealers, expanding the threat landscape beyond traditional browser and wallet data.
The five-minute version
The writeup analyzes samples of the Aokigahara infostealer, detailing its many data-collection modules and its encrypted configuration. It highlights a dedicated "aisessions" handler that extracts credentials and session files from AI services such as Claude, ChatGPT Desktop, Codex, and GitHub Copilot, as well as cloud credentials. The authors confirm the presence of these handlers in real samples but note they have not observed how the stolen data is monetized. Evidence comes from static analysis of the binary and network traces of its C2 communication.
What they found 1
- The malware includes an aisessions handler that extracts AI application credentials and session data
“aisessions | AI/developer-tool credentials and sessions: Claude Code/Desktop, Codex, ChatGPT Desktop, AWS credentials/SSO and Amazon Q, Cursor, Windsurf, Kiro, GitHub Copilot/VS Code, Gemini CLI, and JetBrains AI Assistant.”
What undercuts it the paper’s own results
- The analysis does not confirm how its operators monetize the stolen data.
Stated limits 2
- The analysis does not confirm how its operators monetize the stolen data.
- not every targeted file necessarily contains authentication secrets.
What’s new here 4
- Discovery of a specific aisessions module targeting AI and developer-tool credentials
- Documentation of anti-analysis language and sandbox checks that abort execution
- Reverse-engineered encrypted configuration format and X25519-based C2 key exchange
- Detailed mapping of file paths for AI services and cloud credential stores
Artifacts & methods 3
- Aokigahara stealersystem
- AES-256-GCM encrypted ZIP uploadsprimitive
- X25519 key exchange for C2primitive