Infostealer riding the AI Train

Aokigahara is an infostealer malware observed in the wild that combines traditional data theft capabilities with dedicated routines targeting AI applications, developer tools, and cloud environments. It collects browser credentials and cookies from Chromium-based and Firefox browsers, desktop and browser cryptocurrency wallets, messaging and gaming platform tokens, VPN and FTP client configurations, email profiles, and password manager data. Its distinctive feature is the aisessions handler that targets authentication and session data for AI tools such as Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, as well as cloud credentials for AWS, Azure, and Google Cloud. The ide handler collects local development environment secrets including Git credentials and SSH keys. The malware also captures system information, screenshots, clipboard contents, and deploys a clipper component for clipboard manipulation. The scope of stolen data reflects a shift toward targeting AI services and developer environments, potentially enabling unauthorized access to paid AI accounts, cloud resources, and source code repositories. The analysis does not confirm exploitation or monetization methods. No patch or vendor advisory is available.

The malware enables attackers to steal a broad range of sensitive information including authentication credentials, session tokens, and configuration files for browsers, cryptocurrency wallets, messaging apps, gaming platforms, VPN and FTP clients, email applications, password managers, AI development tools, and cloud environments. This can lead to unauthorized access to personal accounts, paid AI services, cloud resources, and developer repositories. The theft of AI-related credentials and cloud secrets could facilitate account takeover, data exfiltration, and misuse of paid AI services or cloud infrastructure. The presence of a clipper component also suggests potential financial theft via cryptocurrency manipulation. However, the exact impact depends on how attackers leverage the stolen data, which is not confirmed.

No official patch or remediation guidance is provided for this malware. Standard malware defense measures such as endpoint protection, user education to avoid phishing or malicious downloads, and monitoring for suspicious activity are advisable. Because the malware targets local files and credentials, securing local environments with strong access controls and credential management best practices is recommended. Users of AI tools and cloud services should consider rotating credentials and enabling multi-factor authentication where possible. Vendors or security teams should monitor for indicators of compromise related to this malware. Patch status is not yet confirmed — check vendor advisories for updates.