Aokigahara infostealer hunts ChatGPT, Claude, Codex and Cursor sessions

A newly observed Windows infostealer, tracked as Aokigahara, goes well beyond the usual browser passwords and crypto wallets. It carries a purpose-built module that sweeps infected machines for the login tokens, session files and local databases of AI assistants and AI coding tools, including ChatGPT Desktop, Claude Code, Claude Desktop, Codex and Cursor.

To be clear from the start: this is not a breach of any AI provider. The malware steals what is already sitting on a compromised endpoint. But a valid session token is often all an attacker needs to walk into an account without ever typing a password.

What happened

Aokigahara ships with a collection module internally labelled aisessions. On an infected Windows host it looks for:

• Claude credential files and desktop application folders
• Codex authentication, configuration and environment files
• Cursor local storage databases
• ChatGPT Desktop application cache

Its reach extends to Windsurf, GitHub Copilot, Gemini CLI, JetBrains AI Assistant, Amazon Q and Kiro, and it also queries Windows Credential Manager for stored secrets. Not every file it grabs necessarily contains a usable token, but the targeting is deliberate.

A second module, ide, widens the net to Git credentials, SSH keys and AWS, Azure and Google Cloud configuration. On top of that, Aokigahara does everything a conventional stealer does: browser credentials and cookies, screenshots, clipboard contents, wallet, messaging, VPN and email client data. It also drops a clipper component that watches the clipboard for cryptocurrency addresses.

The family appears to be an evolution of an earlier stealer known as Kamidere or Stygian. How its operators turn the stolen data into money has not been established.

How it operates

• Anti-analysis checks are optional and configuration-driven: debugger presence, virtual machine traces, hardware resources, running process counts and mouse movement. The malware also exits when the keyboard or Windows interface language belongs to an excluded group, including Russian, Ukrainian and several regional languages.
• An encrypted configuration (AES-256-CBC) decides which collection modules run and holds server addresses and fallback destinations. Disabled modules stay embedded in the binary, so a sample's real capability can exceed what it does in any single run.
• Exfiltration packs the loot into ZIP archives, encrypts each upload with AES-256-GCM after an X25519 key exchange, and pushes it in stages: a handshake, one or more chunks per collection category, then a completion message. The traffic hides behind a Windows-looking User-Agent string, which alone is not proof of infection.

Around 150 distinct samples have been identified so far, and public detection signatures already exist that key on strings such as AISessions/, aokigahara and kamidere.

Why it matters

Developers now keep an enormous amount of context inside AI tools: private conversations, uploaded documents, repository snippets, architecture decisions and, in agentic setups, the keys those agents use. A stolen session can expose all of it, let an attacker burn through paid usage, resell the account, or extort the victim with sensitive business content. These are plausible outcomes rather than confirmed operator behaviour, but the risk follows directly from how long a stolen token stays valid.

The uncomfortable lesson is that AI session files deserve the same protection as browser passwords and cloud keys, and most incident response playbooks do not yet treat them that way.

What to do

1. Add AI tool sessions to your infostealer playbook. Know where Claude, Codex, Cursor, Copilot and ChatGPT store tokens on your endpoints, and include those paths in forensic triage.
2. Monitor for unexpected processes reading AI authentication stores, editor databases, cloud credential files and SSH material. Pair network indicators with endpoint evidence instead of treating either as standalone proof.
3. After a suspected infection, isolate the device, then from a clean system revoke AI sessions, rotate API keys, SSH keys and cloud credentials, and review connected repository and cloud accounts.
4. Do not stop at a password reset. Stolen sessions can remain usable after the password changes. Terminate them explicitly and check AI account activity for access you do not recognise.
5. Review what was reachable. Determine which conversations, uploads and projects the compromised account could see, and treat that content as exposed.

Stolen stealer logs rarely stay with the first attacker; tokens, cookies and credentials are typically bundled and traded on underground markets within days. 4tify's Deep/Dark Web monitoring watches those channels for your organisation's domains, accounts and keys, so a leaked AI session can be revoked before someone else gets to use it.

Indicators of compromise

C2 (defanged)
2[.]26[.]252[.]48:8080
dfwioeiofwr[.]info
gate[.]dfwioeiofwr[.]info
dobeqnesmot[.]cc
hjazfioe[.]surf
kkeyyou[.]cc
neihite[.]cc
somelitersofblood[.]pw

Upload paths:   /gate/handshake  /gate/chunk  /gate/complete
User-Agent:     Microsoft-CryptoAPI/10.0
Marker strings: STGC  AISessions/  aokigahara  kamidere
Clipper drop:   C:\Microsoft\Vault  (SHA-1 8d6c86e0af7807f9b5baf15e9f076bb81e012515)

IP addresses and domains are defanged on purpose. Re-fang them only inside controlled threat-intelligence tooling such as your SIEM or a MISP instance.