Symantec: the Aoki infostealer now steals credentials and session files of AI coding assistants (Claude, Codex, Cursor, Gemini, Copilot, Kiro)
Confirmed
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 2 of 5
- Last verified
- 29 October 2026
Your AI and this story
- GPT-6 Astra168 days after its cutoff
- Claude Opus 5.5107 days after its cutoff
- Gemini 4 Argon198 days after its cutoff
- Grok 4.7137 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 107 days before it.
Key facts
- New targets (Symantec): .claude.json, Claude desktop cookies, ChatGPT cookies, Codex config.toml and .env files; tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro; AWS credentials
- Why it matters (Symantec): stolen API keys and OAuth/session tokens let attackers act under a developer’s identity and quota and can expose linked repositories, cloud services and CI/CD pipelines; it stole credential files, not source code, except Cursor’s local state database, which can cache chat context and code snippets
- The malware has no backdoor command list; it sends whatever it collects to a C&C ‘/gate’ endpoint. Symantec does not know who is behind it and found no link to an existing malware family
- Symantec described the AI targeting as ‘a new development that hasn’t previously been reported’
What happened
Commodity malware has started to treat AI coding tools as a store of valuable secrets. Symantec’s analysis of the newest Aoki samples found a list of AI-assistant files and tokens added to its usual theft list.
Why it matters
AI keys are sold and abused for “LLMjacking” (running models on a victim’s bill), and coding-agent tokens can open the repositories and pipelines they are connected to. The report was found two weeks late, through Symantec’s Oct 29 relay report.
Sources
1 source from 1 site. Numbers match the chips in the text.
1 source: 1 primary
Primary
Changes
- Filed from Symantec’s report, read directly (news agent; found via the related posts of the Oct 29 relay report)