New versions of the Aoki infostealer are targeting credential and session files used by popular AI coding assistants, a new report by Symantec warned. This represents a significant development from earlier versions of Aoki, which focused on browser, cryptocurrency wallet and password manager data, and did not target AI-related files, based on information published by Infosecurity Magazine.
The infostealer can now access API keys and tokens from AI coding assistants such as Anthropic's Claude, OpenAI's Codex, SpaceX's Cursor, and Google's Gemini. This allows threat actors to conduct malicious activities under a legitimate developer's identity and API quota, bypassing security measures. The stolen tokens can also expose connected repositories, cloud services, and CI/CD pipelines. The newest version of Aoki targets specific files like .claude.json, Claude desktop cookies, ChatGPT cookies, and Codex config.toml and .env files, along with tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant, Kiro, and AWS credentials. Symantec notes that AI credentials are now as valuable as payment card data and cryptocurrency wallets to threat actors, enabling direct financial gain through resale or account usage, a practice known as LLMjacking. The attackers appear to be financially motivated, though no specific threat group has been identified as being behind Aoki.
Source: Infosecurity Magazine
