Check Point Research (CPR) researchers have discovered Aokigahara, an infostealer, a type of malware designed to steal personal and professional data. Recently observed, this program is not limited to browser passwords: it also targets credentials and session data linked to ChatGPT Desktop, Claude, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other AI and development tools.
A Capability Dedicated to AI Tools
Once installed on a device, Aokigahara searches for valuable information: browser credentials, cookies (small files that keep a connection open), cryptocurrency wallets, but also authentication files, session data, and configurations related to AI, development, and cloud tools. The data is gathered into encrypted archives, then sent to the malware’s command and control server, which could give attackers access to multiple credentials from a single compromised device.
What distinguishes Aokigahara is its capability dubbed “aisessions,” which notably targets Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI. If the stolen authentication tokens are valid, they could allow access to an account without the user’s password, endangering private conversations, development data, and paid AI services. CPR cannot confirm if the operators have reused or resold these credentials, but the malware is deliberately designed to collect them.
The Developer Workstation, a Gateway to Many Services
The malware also targets Git credentials, SSH-related files, as well as AWS, Azure, and Google Cloud credentials and configurations. VS Code, Cursor, Windsurf development environments and JetBrains products are also targeted. A single device can thus contain access to AI assistants, source code repositories, cloud environments, and development services.
CPR specifies that the AI and development-related capabilities function as separate modules, and the research does not establish that attackers deliberately chain them in a single attack. Their joint presence nonetheless illustrates the quantity of high-value access that a modern developer’s computer can contain. Compromised credentials could also enable unauthorized use of paid AI services, generate additional costs, or be resold, while sensitive conversations or files could pave the way for extortion, an activity CPR has not observed among Aokigahara operators.
For years, infostealers primarily targeted passwords, browser sessions, financial information, and cryptocurrencies. With the growing use of AI assistants alongside code and corporate data, AI sessions and credentials are becoming an additional identity asset. For organizations, this implies protecting not only what employees input into these services, but also the tokens and sessions that provide access to them, and taking them into account during incident response after a workstation compromise.
Eli Smadja, Research Manager at Check Point Research, stated: “In the future, securing AI will increasingly mean securing not only the models and the data that goes into them, but also the identities and access surrounding them.”
