# Aoki: an infostealer now takes AI coding assistant credentials

> Aoki, an infostealer first seen earlier in 2026, now collects the keys and session files of AI coding assistants.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Incident, Attack
- **Published by:** Symantec
- **Disclosed:** 2026-10-15
- **Affects:** Claude, Claude Desktop, ChatGPT, OpenAI Codex, Cursor, GitHub Copilot, Google Gemini, JetBrains AI Assistant, Kiro, Codeium
- **Research by:** Threat Hunter Team (Symantec and Carbon Black, Broadcom)
- **Primary source:** https://www.security.com/threat-intelligence/aoki-infostealer-ai-targeting
- **Page:** https://theinjection.dev/items/symantec-aoki-ai-coding-credentials/

Aoki is an infostealer whose newest samples collect AI coding assistant credentials, from .claude.json and Claude desktop cookies to Codex config.toml and tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro.

## What happened

Symantec's Threat Hunter Team published its analysis of Aoki on October 15, 2026, reporting that newer samples of the malware target AI-related files. Earlier versions of Aoki did not. Symantec says the family first appeared earlier in 2026, the operators are unknown, and the team found no links to existing malware families.

## How it works

Aoki is a collector rather than a backdoor: it has no command list, takes whatever data is available on the machine, and posts it to a /gate endpoint on its command-and-control server. What it reads from AI tools is configuration, token and cookie files on disk, listed below, plus Cursor's local state database, which can cache chat context and code snippets. Symantec notes that database as the one exception to a haul that is otherwise credentials and sessions, not source code.

## Who is affected

Developer machines with any of ten named AI assistants installed are the new part of the target list, on top of about 50 browsers, about 90 wallet browser extensions, about 20 desktop wallets, Discord and Telegram clients, Outlook and Thunderbird, FTP and VPN clients, and password managers including Bitwarden and 1Password. AWS credentials are taken as well. Exposure follows endpoint compromise: Symantec describes no breach at any AI provider, and publishes no victim count.

## What to do

Rotate the API keys and tokens of every AI assistant used on a machine that may have run Aoki, and revoke its browser and desktop sessions. Check endpoints against the 17 file hashes and three command-and-control addresses Symantec publishes. Symantec Endpoint products detect the family as Infostealer.Aoki.

## Quick facts

- **Affected:** Claude, Claude Desktop, ChatGPT, OpenAI Codex, Cursor, Codeium, Google Gemini, GitHub Copilot, JetBrains AI Assistant, Kiro
- **AI files taken:** .claude.json, Claude desktop cookies, ChatGPT cookies, Codex config.toml, .env files, Cursor local state database
- **Also taken:** AWS credentials, browser and wallet data, Discord and Telegram files, password manager data
- **Detection:** Infostealer.Aoki, Symantec Endpoint
- **Command and control:** dobeqnesmot[.]cc/gate, hjazfioe[.]surf/gate, neihite[.]cc/gate
- **Found by:** Threat Hunter Team, Symantec
- **Disclosed:** October 15, 2026; attribution unknown

## Questions

### Does Aoki steal source code from developer machines?

Aoki takes credential, token and session files rather than source code, with one exception Symantec records: Cursor's local state database, which can cache chat context and code snippets. The AI haul is otherwise configuration and cookie files such as .claude.json, Codex config.toml and .env files, plus tokens for several other assistants.

### Which AI coding assistants does Symantec name as targets?

Symantec names Claude, Claude Desktop, ChatGPT, OpenAI Codex, Cursor, Codeium, Google Gemini, GitHub Copilot, JetBrains AI Assistant and Kiro. Aoki looks for their configuration, token and cookie files on the infected machine. The same samples also take AWS credentials, so one compromised laptop can hand over cloud access alongside model API access.

### What can an attacker do with a stolen AI assistant key?

Symantec says a stolen AI key lets an attacker act under a legitimate developer's identity and API quota, and that the tokens can expose connected repositories, cloud services and CI/CD pipelines. The report ties running up usage on a victim's account to LLMjacking, and judges AI credentials to be as valuable to attackers as payment card data.

### How do I check whether a machine ran Aoki?

Symantec publishes 17 SHA-256 hashes for Infostealer.Aoki plus three command-and-control addresses: dobeqnesmot[.]cc/gate, hjazfioe[.]surf/gate and neihite[.]cc/gate. Most newer samples use one domain and two use another, while older samples called an IP address on port 8080 over unencrypted HTTP. Symantec Endpoint products detect the family and block known malicious files.

## Sources

1. [Symantec Analysis](https://www.security.com/threat-intelligence/aoki-infostealer-ai-targeting)
2. [Infosecurity Coverage](https://www.infosecurity-magazine.com/news/aoki-infostealer-ai-coding/)