A newly observed Windows infostealer has a dedicated routine for something most stealers ignore: the login files and session data of AI assistants and AI coding tools. Check Point Research has named it Aokigahara, and says an earlier version may have circulated as Kamidere or Stygian.
The target list reads like a developer's taskbar: Claude Code and Claude Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, Kiro, GitHub Copilot in VS Code, Gemini CLI, Amazon Q and JetBrains AI Assistant. Alongside them it collects Git credential files, SSH private keys and AWS, Azure and Google Cloud credential files.
The handler is literally called aisessions
Check Point found the malware organised into internal modules, each switched on or off by a bitmask in an encrypted configuration. One of them, aisessions, walks a fixed list of file paths such as the .claude credentials file, the .codex auth and .env files, Cursor and Windsurf state databases, Copilot host files and Gemini CLI token files, and also queries Windows Credential Manager. A separate ide handler sweeps VS Code, Cursor, Windsurf and JetBrains data for Git credentials, files under .ssh and cloud configuration.
The researchers are careful about what this means. Not every targeted file necessarily contains a secret, and the analysis does not confirm how the operators make money from the haul. What the code does establish is intent: a usable token or API key can let an attacker into a paid AI account or a cloud environment without a password, and could expose private conversations, uploaded files and source code. Check Point raises resale of compromised AI accounts, unauthorized use of paid services and data extortion as plausible routes.
Everything else a modern stealer takes
The rest of Aokigahara is conventional but broad: saved logins and cookies from dozens of Chromium browsers and Firefox, desktop and browser-extension crypto wallets, Discord and Telegram data, Steam, Roblox and other gaming accounts, Outlook and Thunderbird mail profiles, VPN and FTP client configs, and password manager data including KeePass, Bitwarden and 1Password. It takes screenshots, grabs files from Desktop, Documents and Downloads, and drops a separate clipboard-hijacking component.
It also refuses to run on systems set to Russian, Ukrainian, Belarusian, Kazakh and several other regional languages, and checks for debuggers, virtual machines and sandbox-style usernames. Stolen data is zipped, encrypted with AES-256-GCM after an X25519 key exchange, and posted in chunks to /gate/handshake, /gate/chunk and /gate/complete endpoints using the User-Agent Microsoft-CryptoAPI/10.0. Check Point says the stealer appears to be under active development. Wiz reached a similar conclusion from the other side, finding AWS keys and AI credentials high on the list of what stealers already take.
Treat AI tokens like cloud keys and rotate them
- Treat AI tool credentials and session files as sensitive secrets, on par with browser sessions and SSH keys. On any machine with a suspected stealer infection, sign out of and re-authenticate Claude, ChatGPT, Codex, Cursor, Copilot and similar tools, and revoke their API keys.
- Rotate Git tokens, SSH keys and cloud credentials stored on that host, and review cloud and AI account activity for unexpected usage or billing.
- Hunt for HTTP POSTs to /gate/handshake, /gate/chunk and /gate/complete paths with the Microsoft-CryptoAPI/10.0 User-Agent and X-Gate-Token, X-Chunk and X-HWID headers.
- Prefer short-lived, SSO-backed credentials for developer tooling so a stolen file expires quickly.
Indicators of compromise
A sample of the Aokigahara SHA1 hashes Check Point published (the full list is in the original report):
- 007137599bc4d69ee952a5228b5fcb2c3b9a95a7
- 00d52c7e759d878f0d8a117502f6d854af13f007
- 04eddccb79db41e03a4ee8542e8a33d7f1d9fe18
- 057a2d1dedeb93b7765c455a9e0c469e7cbe4843
- 079ddf5cc7d6ca2e02f860f87d4d18c83db9d331
The lesson is less about one stealer than about the inventory. The folder that holds a developer's AI assistant login is now worth stealing, and most organisations have never listed it among the secrets they protect.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.