Brief · Builders

A newly spotted infostealer wants your AI logins now.

By alkizz · Oct 27, 2026

Check Point Research published an analysis on Oct 23 of Aokigahara, a newly observed infostealer that it says has been spotted in the wild (an earlier version may have been known as Kamidere or Stygian). Most of it is the usual stealer shopping list of browser passwords, cookies, crypto wallets, VPN clients and password managers, but it also has a handler called aisessions that goes after the login files of your AI tools. Check Point names Claude Code and Claude Desktop, Codex, ChatGPT Desktop, Cursor, Windsurf, GitHub Copilot, Gemini CLI, Kiro, Amazon Q and JetBrains AI Assistant, plus AWS credentials and SSO data.

Nobody had to jailbreak a model or invent a clever prompt injection for any of this. The attackers simply noticed that your coding agent keeps a token on disk and went to pick it up, and if that token is still valid, it can be a live session into whatever the agent can reach, which for a lot of us means our code, our cloud account and our bill.

What's actually confirmed

Before anyone declares the AI apocalypse, here's what the Check Point write-up supports and what it doesn't:

• The targeting is real and specific. Check Point lists the exact paths the handler collects, such as .claude\credentials.json, .codex\auth.json, .aws\credentials and .aws\sso\cache. A separate ide handler goes after Git credential files, files under .ssh that may contain private keys, and AWS, Azure and Google Cloud credential and configuration files.
• Not every file it grabs holds a secret. In Check Point's words, these files "may contain tokens, credentials, session data, or settings; not every targeted file necessarily contains authentication secrets."
• Every path Check Point lists is a Windows path, and the malware also queries Windows Credential Manager, so that's the platform this analysis covers.
• How the money gets made is a guess. Check Point says stolen AI credentials could be used to run up paid services, be resold or support data extortion, but it is clear that "the analysis does not confirm how its operators monetize the stolen data."
• We don't know how it spreads or how many people it hit. The write-up doesn't say how victims get infected or give a victim count, so I'm not going to make one up.

Why your laptop is the target

This fits a pattern that the breach data has been showing for a while, though it's worth being honest about which way the numbers point. In Verizon's 2026 DBIR, exploiting vulnerabilities is the number one way into breaches overall at 31%, ahead of credential abuse at 13%, so patching still matters and nobody gets to skip it. Credentials still show up somewhere in 39% of breaches, and in ransomware they dominate: Beazley Security's Q2 2026 report says "67% of intrusions started with compromised credentials against exposed VPN and RDP," which covers the ransomware intrusions it investigated that quarter only.

An infostealer is basically a machine for turning one infected laptop into a pile of working logins, and Aokigahara has put the AI tools on a developer's laptop on its list. If you've ever wondered why you'd bother stealing someone's Codex session, Check Point's answer is that it can expose "private conversations, source code, and other sensitive information" and let attackers "consume paid services, generate unauthorized charges, or support further attacks." DBS covered a related case when a poisoned LiteLLM release stole cloud credentials that were being tested within hours.

The score

I'd call it a 3, patch normally, because it's real malware with real AI-tool targeting, but there's no confirmed victim count, no known delivery route and no confirmed monetization, and none of it is a bug in Claude, Codex or Cursor that a vendor can patch. If an infostealer is already on your machine, the AI tokens are one item on a long list, so the fix is good credential hygiene rather than panic.

My take: Credentials, session keys, cookies and the like have been targets of infostealers for a long time. Nothing new there, but there's a growing list of ways configs can catch you off guard. I know it might sound like a broken record, but it's back to the basics for us again.

What to do:

• Know where your AI tools keep their logins.

  • Why: you can't protect or rotate a token you don't know exists, and a stealer only needs to know the path.
  • How: Check Point's tables give the Windows paths for each tool, such as .claude\credentials.json, .codex\auth.json, Cursor's globalStorage\state.vscdb, .copilot\hosts.json and .gemini\.env. For anything else, look up the tool's own documentation on where it stores credentials and check your home folder for the matching dot-folders, rather than trusting a path from a random blog.

• Keep long-lived keys off your dev laptop.

  • Why: a stealer copies whatever is on disk, and a static key keeps working until someone notices, while a short-lived credential expires on its own.
  • How: AWS recommends that human users get "temporary credentials" through federation, with IAM Identity Center for central access, instead of long-term access keys in .aws\credentials. Note that the SSO cache is on Check Point's list too, so short-lived credentials shrink the window rather than closing it. Our builders checklist has the same rule for API keys: get them out of your prompts, repos and dotfiles.

• Scope every key and rotate it.

  • Why: one shared "god key" means one stolen laptop burns everything.
  • How: use one key per tool with the smallest permissions it needs (builders item 2). AWS recommends least-privilege permissions and removing unused credentials, and it says to update long-term access keys when you need them, such as when someone leaves. If a machine gets infected, sign out of every AI tool on it, revoke its tokens and rotate any key it could read, then check what those keys did. Anthropic recommends revoking a suspect API key immediately and reviewing the Console's Logs and Usage pages. For AWS keys, AWS says to update the access key, deactivate the original rather than deleting it straight away, and check CloudTrail event history and your bill for activity you don't recognize. Do this from a clean device, or the stealer can pick up the new keys too.

• Set billing caps and alerts.

  • Why: one use Check Point names for a stolen AI session is running up your paid services, and a cap turns a surprise bill into a blocked request.
  • How: in the Claude Console you can set your own monthly spend limit below your tier's cap on the Billing page, and per-workspace limits too (except on the default Workspace). In AWS, a Budgets cost budget can alert you on actual and forecasted spend. AWS notes there can be a delay before a Budgets alert fires, so treat it as a smoke alarm rather than a wall.

• For businesses: Check Point's own conclusion is that AI application credentials and session data "should be treated as sensitive assets alongside browser sessions, cloud credentials, and developer keys." Put AI tool tokens in the same offboarding and incident-response runbooks as your VPN and cloud credentials, and if a developer laptop gets hit by a stealer, revoke their AI sessions as well as their passwords.

Sources

• Check Point Research: Infostealer riding the AI Train (Oct 23, 2026)
• Verizon: 2026 Data Breach Investigations Report (news release)
• Verizon: 2026 Data Breach Investigations Report (PDF)
• Beazley Security: Quarterly Threat Report, Q2 2026
• AWS: Security best practices in IAM
• AWS: Managing your costs with AWS Budgets
• AWS re:Post: Resolve issues with unauthorized activity in AWS accounts
• Anthropic Help Center: API key best practices
• Anthropic: Rate limits

← All briefs