Aoki Infostealer Adds AI Coding Assistant Tokens to Its Haul

Key Takeaways

• Symantec found new versions of the Aoki infostealer targeting AI coding assistant credentials.
• Targets include Claude, OpenAI Codex, ChatGPT, Cursor, Gemini, GitHub Copilot, JetBrains AI Assistant, and Kiro.
• Stolen tokens let attackers impersonate developers and reach repositories, cloud accounts, and pipelines.
• The campaign appears financially motivated, with no known link to an existing threat group.
• Infection counts have not been reported.

AI Credentials Join the Infostealer Shopping List

Malware that once focused on browser passwords and crypto wallets now goes after the tokens AI coding agents use. As Infosecurity Magazine reported, Symantec found the Aoki infostealer harvesting session and configuration files from most major coding assistants, giving attackers a direct path into developer environments.

What We Know

Symantec's Threat Hunter Team published its findings on October 15, 2026. Earlier Aoki versions stole browser data, cryptocurrency wallets, and password manager contents. New builds add files such as .claude.json, Claude desktop and ChatGPT cookies, Codex config.toml and .env files, and tokens for Cursor, Gemini, GitHub Copilot, JetBrains AI Assistant, Kiro, and AWS.

Symantec said it does not know who operates Aoki and sees no ties to a known malware family. The focus on cryptocurrency suggests financial motivation. SC World noted Symantec's view that AI credentials are now as valuable to criminals as payment card data, whether resold or used directly in LLMjacking. The number of infected machines was not disclosed.

What Happened

AI coding assistants store long-lived tokens and session cookies in predictable local files so developers do not have to sign in repeatedly. An infostealer running on the same machine can simply copy them. Unlike a password, a session token often bypasses multifactor authentication entirely.

The AI-specific risk is what those tokens unlock. Coding agents are commonly granted access to source repositories, cloud consoles, MCP servers, and CI/CD systems. An attacker holding an agent's token inherits that reach and can run the agent itself against the victim's environment, with activity that looks like normal developer work.

Why It Matters

Developer laptops have become credential vaults for AI tools, and most security programs do not inventory those secrets. A single infection can expose source code, cloud resources, and paid model quota, and stolen access can be resold. Organizations may not notice until unexpected usage bills or repository changes appear.

This follows a pattern already seen on the tracker in Infostealers Raid AI Coding Agents for Tokens and MCP Configs. Rotating AI tool tokens after any endpoint infection should now be standard practice.

PointGuard AI Perspective

AI coding agents need to be governed where they run. PointGuard AI Agentic Endpoint Security discovers coding assistants and their configuration on developer machines, flags exposed tokens and MCP settings, and applies policy to agent actions so stolen credentials are harder to use quietly.

PointGuard AI Agent Identity and Access Security ties each agent to a verified identity with scoped, short-lived permissions, reducing the value of any single stolen token and making anomalous use easier to detect. As AI tools become part of every developer workflow, protecting their credentials deserves the same priority as protecting passwords and keys.

Incident Scorecard Details

Total AISSI Score: 6.5/10

Criticality: 7, Tokens unlock source code, cloud accounts, and CI/CD systems tied to coding agents. AISSI weighting: 25%

Propagation: 7, One stolen token can extend to every repository, MCP server, and pipeline an agent reaches. AISSI weighting: 20%

Exploitability: 7, Active malware in the wild is harvesting these credentials. AISSI weighting: 15%

Supply Chain: 7, Risk centers on third-party AI tools and how they store credentials locally. AISSI weighting: 15%

Business Impact: 5, No confirmed downstream breaches or infection counts reported yet. AISSI weighting: 25%

Sources

Third-Party Sources

• Infosecurity Magazine: New Aoki Infostealer Targets AI Coding Assistant Credentials
• SC World: New infostealer targets AI coding assistant credentials

PointGuard AI Sources

• PointGuard AI Incident Tracker: Infostealers Raid AI Coding Agents for Tokens and MCP Configs
• PointGuard AI Agentic Endpoint Security
• PointGuard AI Agent Identity and Access Security