Aokigahara Malware Alert: New Threat Steals Login Credentials from ChatGPT, Claude, Codex, and Cursor

A newly discovered Windows information-stealing malware known as Aokigahara is targeting authentication credentials and session data stored by popular AI applications, including ChatGPT Desktop, Claude, Codex, and Cursor.

The malware searches infected systems for locally stored authentication files, application databases, and other sensitive information. Its approach reflects a growing cybersecurity concern: as developers increasingly rely on AI assistants for coding and everyday work, the credentials and session data associated with these tools are becoming attractive targets for cybercriminals.

However, this discovery does not mean that ChatGPT, Claude, Codex, or Cursor has been breached. Instead, Aokigahara attempts to steal sensitive information directly from compromised computers, potentially allowing attackers to access accounts if the stolen credentials or session tokens remain valid.

Researchers at Check Point identified the malware in the wild and documented its capabilities in a research report published on October 23. According to the researchers, an earlier version may have been associated with the names Kamidere or Stygian, although the operators' monetization strategy remains unconfirmed.

Aokigahara Malware Targets AI Applications and Developer Credentials

One of Aokigahara's most notable features is a dedicated collection module called aisessions. This component searches infected Windows systems for data associated with a wide range of AI applications and coding assistants.

The targeted applications include:

• ChatGPT Desktop
• Claude Desktop and Claude Code
• OpenAI Codex
• Cursor
• Windsurf
• GitHub Copilot
• Gemini CLI
• JetBrains AI Assistant
• Amazon Q
• Kiro

The malware also queries Windows Credential Manager for stored credential information.

Rather than focusing exclusively on conventional browser passwords, Aokigahara expands its collection efforts into the local files and storage locations used by AI-powered development tools. These locations may contain authentication tokens, configuration details, session information, or other data that could be useful to an attacker.

The exact information available depends on the application, the files present on the infected machine, and whether the targeted data contains usable secrets.

How Aokigahara Collects AI Login Information

The malware searches different storage locations depending on the application it targets.

For Claude, its collection activity includes credential files and desktop application directories. For Codex, it looks for authentication records, configuration files, and environment-related data.

Cursor's local storage databases are also targeted, while ChatGPT Desktop's application cache is included in its searches.

Not every file collected by the malware necessarily contains a password or authentication token. However, even a small amount of valid session data could create a serious security risk.

Earlier research into AI credential theft has highlighted a similar problem: attackers do not always need to steal a user's password if they can obtain an active session token or another reusable authentication artifact.

If such information remains valid, it may allow unauthorized access without requiring the attacker to enter the victim's password again.

Depending on the permissions associated with the compromised account, this could expose private conversations, uploaded files, development records, or other sensitive information. Attackers might also misuse paid services or attempt to sell access to compromised accounts.

Check Point identified these as potential consequences rather than confirmed actions by Aokigahara's operators. The researchers also noted the possibility of data extortion if stolen access exposes confidential business information.

Beyond AI: Git, SSH, and Cloud Credentials Are Also at Risk

Aokigahara's collection capabilities extend beyond AI applications.

Another component, named ide, searches for information associated with developer tools and cloud environments. Its targets include Git credentials, SSH files that may contain private keys, and configuration data associated with AWS, Azure, and Google Cloud.

This broader collection strategy is particularly concerning for developers and organizations that use a single workstation to access multiple environments.

For example, a compromised development computer might contain authentication material for source-code repositories, cloud infrastructure, and AI coding assistants. If attackers obtain valid credentials from several of these sources, the potential impact could extend beyond one application or user account.

The malware also collects conventional browser credentials and cookies, captures screenshots and clipboard contents, and searches for data associated with cryptocurrency wallets, messaging platforms, VPN software, and email applications.

This makes Aokigahara more than an AI-focused credential stealer. Its AI collection module is part of a broader information-stealing operation designed to gather valuable data from compromised Windows systems.

Evasion Techniques Help Aokigahara Avoid Analysis

Aokigahara includes several optional checks that may help it evade malware analysis and security monitoring.

Depending on its configuration, the malware can inspect systems for signs of debugging, virtual machines, limited hardware resources, unusual process counts, and mouse activity. These checks may help it identify environments commonly used by security researchers to analyze suspicious software.

The malware can also terminate its execution when certain keyboard or Windows interface language settings match an excluded group. The reported exclusions include Russian, Ukrainian, and several regional languages.

These checks do not guarantee that the malware will evade detection. Instead, they represent additional conditions that may influence whether particular samples execute their collection routines.

Encrypted Configuration and Data Transfers

Aokigahara uses AES-256-CBC encryption to protect its configuration. This configuration determines which built-in collection modules are enabled and can contain server information, communication settings, and fallback destinations.

An important detail is that disabled modules remain embedded in the executable. As a result, a malware sample may contain more capabilities than it actually uses during a particular execution.

For data exfiltration, Aokigahara packages collected information into ZIP archives and encrypts uploads using AES-256-GCM. An X25519 key exchange helps establish the encryption key used for the transfer.

The upload process involves separate requests to initiate a session, transfer individual categories of collected data, and signal completion.

The latest analyzed samples also use a Windows-like User-Agent string in their network communications. However, this detail alone is not sufficient to confirm an infection.

Upload headers identify collection categories and sequence numbers, helping the receiving server distinguish between browser data, AI session information, and other stolen material.

A final completion message indicates that the upload phase has ended. It does not independently establish that every archive was successfully received by the server.

A Growing Cybersecurity Risk for AI-Powered Development Tools

Aokigahara highlights a broader shift in the way cybercriminals target developer environments.

AI assistants and coding agents can become part of daily development workflows, with users relying on them to review code, troubleshoot errors, generate content, and work with project information. Their associated application data may therefore contain access credentials or other sensitive material.

A separate campaign involving a fake Gemini npm package has also targeted local data associated with multiple AI tools. Although that campaign does not establish how Aokigahara is distributed, both cases demonstrate why AI application storage deserves attention in endpoint security programs.

The central issue is not necessarily a weakness in the AI service itself. It is the possibility that malware running on a compromised device can access information that the user or application has stored locally.

Organizations should therefore treat AI session tokens, developer credentials, cloud configuration files, and repository access as important security assets.

How to Detect and Respond to Aokigahara Malware

Security teams should look for suspicious processes accessing AI authentication stores, editor databases, cloud credentials, and SSH files. These findings should be correlated with endpoint telemetry, process activity, and network evidence rather than treated as proof of infection on their own.

Check Point has also published a YARA rule to help security professionals identify the malware.

If Aokigahara or another information stealer is suspected, organizations should prioritize the following response measures:

1. Isolate the affected device. Disconnect the suspected endpoint from the network where appropriate to limit further data theft and prevent additional malicious activity.
2. Use a clean device for account recovery. Avoid changing credentials from a potentially compromised computer.
3. Revoke active sessions and rotate exposed secrets. Invalidate AI application sessions where possible, replace exposed API keys, and rotate affected Git, SSH, and cloud credentials.
4. Review account and service activity. Look for unexpected logins, unfamiliar API usage, suspicious repository access, and unusual cloud activity.
5. Assess potential data exposure. Determine whether private conversations, uploaded documents, source code, or other confidential information may have been accessed.
6. Investigate the endpoint before returning it to service. Identify the infection source, establish the scope of compromise, and follow the organization's remediation and recovery procedures.

Resetting a password alone may not be enough. If an attacker has stolen a reusable session token or another valid authentication artifact, that access may remain available until the relevant session or credential is revoked.

Organizations should also review access permissions and reduce unnecessary privileges wherever possible.

Conclusion

Aokigahara demonstrates how information-stealing malware is expanding its focus beyond traditional browser passwords and into the AI applications developers use every day.

By targeting locally stored authentication data associated with ChatGPT, Claude, Codex, Cursor, and other development tools, the malware creates a potential path to unauthorized account access, sensitive project information, and connected cloud resources.

The findings do not indicate that the targeted AI services themselves have been breached. Instead, they reinforce the importance of securing the devices where authentication information is stored and used.

For individuals and organizations adopting AI-powered development tools, the lesson is straightforward: protect AI sessions and developer credentials with the same care as browser passwords, API keys, SSH keys, and cloud access tokens.

Strong endpoint protection, prompt credential rotation, session revocation, and continuous monitoring can help reduce the impact of information-stealing malware and limit the damage if a workstation is compromised.