Infostealer riding the AI Train

Aokigahara is an infostealer malware targeting traditional data sources such as browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications. It uniquely targets AI applications and development tools, stealing authentication files, session data, and configuration files from services like Claude, ChatGPT Desktop, Codex, and GitHub Copilot. It also collects developer credentials including Git files, SSH private keys, and cloud service credentials (AWS, Azure, Google Cloud). The stolen AI credentials may be used for unauthorized access, account resale, or data extortion. The malware uses anti-analysis techniques and secures its command-and-control communications with AES-256 encryption and X25519 key exchange.

• Aoki: Infostealer Targets AI Coding Assistant CredentialsMalware2026-10-15
• LiteLLM supply chain compromiseCampaign2026-10-22
• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• The Psychedelic Stealer: When the CAPTCHA Is the InstallerMalware2026-09-25
• August 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-02