{"schema":"postcutoff/event@1","as_of":"2026-11-03T13:35:00+01:00","url":"https://postcutoff.com/e/2026-10-15-symantec-aoki-infostealer-ai-coding-credentials/","md":"https://postcutoff.com/e/2026-10-15-symantec-aoki-infostealer-ai-coding-credentials/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"human editor","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-10-15-symantec-aoki-infostealer-ai-coding-credentials","date":"2026-10-15","date_precision":"day","short_title":"Symantec: the Aoki infostealer now steals credentials and session files of AI coding assistants (Claude, Codex, Cursor, Gemini, Copilot, Kiro)","deck":null,"takeaway":null,"category":"policy-safety","category_label":"Policy & safety","importance":2,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":[{"n":1,"title":"Symantec Threat Hunter Team: Aoki: infostealer targets AI coding assistant credentials (Oct 15)","url":"https://www.security.com/threat-intelligence/aoki-infostealer-ai-targeting","type":"official","group":"primary","domain":"security.com"}],"official":1,"filed":"2026-10-29","updated":"2026-10-29","orgs":["Symantec","Broadcom"],"title":"Symantec: the Aoki infostealer now steals credentials and session files of AI coding assistants (Claude, Codex, Cursor, Gemini, Copilot, Kiro)","summary":"On Oct 15, 2026 Symantec's Threat Hunter Team reported that recent versions of the little-documented Aoki (\"Aokigahara\") infostealer, first seen earlier in 2026, harvest credential and session files of AI coding assistants: .claude.json and Claude desktop cookies, ChatGPT cookies, Codex config.toml and .env files, and tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro, along with the usual browser, wallet and password-manager data. Older samples did not look for AI files.","key_facts":["New targets (Symantec): .claude.json, Claude desktop cookies, ChatGPT cookies, Codex config.toml and .env files; tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro; AWS credentials","Why it matters (Symantec): stolen API keys and OAuth/session tokens let attackers act under a developer's identity and quota and can expose linked repositories, cloud services and CI/CD pipelines; it stole credential files, not source code, except Cursor's local state database, which can cache chat context and code snippets","The malware has no backdoor command list; it sends whatever it collects to a C&C '/gate' endpoint. Symantec does not know who is behind it and found no link to an existing malware family","Symantec described the AI targeting as 'a new development that hasn't previously been reported'"],"key_numbers":[],"tags":["cybersecurity","malware","infostealer","coding-agents","credentials","api-keys"],"science":null,"body_md":"## What happened\n\nCommodity malware has started to treat AI coding tools as a store of valuable secrets. Symantec's analysis of the newest Aoki\nsamples found a list of AI-assistant files and tokens added to its usual theft list.\n\n## Why it matters\n\nAI keys are sold and abused for \"LLMjacking\" (running models on a victim's bill), and coding-agent tokens can open the repositories\nand pipelines they are connected to. The report was found two weeks late, through Symantec's Oct 29 relay report.","disputed":[],"related":[{"id":"2026-10-29-symantec-grey-market-relay-codex-claude-code-sandbox-off","url":"https://postcutoff.com/e/2026-10-29-symantec-grey-market-relay-codex-claude-code-sandbox-off/","date":"2026-10-29","date_precision":"day","short_title":"Symantec: a grey-market relay installs the real Codex and Claude Code CLIs in China-based firms, then switches their sandboxes off and routes every prompt through its own servers","deck":null,"takeaway":"Symantec saw no abuse yet, but notes the operator could read every prompt, file and secret and run commands with the user's privileges.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":2,"official":1,"filed":"2026-10-29","updated":"2026-10-29","orgs":["Symantec","Broadcom","OpenAI","Anthropic"]},{"id":"2026-10-21-symantec-skynet-mode-llmjacking-agent","url":"https://postcutoff.com/e/2026-10-21-symantec-skynet-mode-llmjacking-agent/","date":"2026-10-21","date_precision":"day","short_title":"Symantec: offensive agent hijacks LLMs in 'Skynet mode'","deck":null,"takeaway":"It is a concrete look at how criminals are packaging agentic attacks: not a frontier lab's model behind safeguards, but someone else's exposed endpoint doing the thinking, with the victim paying for inference.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":2,"official":1,"filed":"2026-10-22","updated":"2026-10-22","orgs":["Symantec"]},{"id":"2026-09-27-google-gtig-dark-web-ai-access-llmjacking","url":"https://postcutoff.com/e/2026-09-27-google-gtig-dark-web-ai-access-llmjacking/","date":"2026-09-27","date_precision":"day","short_title":"Google: dark-web markets sell access to top AI models at up to 97% off","deck":null,"takeaway":"It shows frontier-model access becoming a commodity for criminals, which matters for misuse safeguards that depend on account-level monitoring and bans.","category":"policy-safety","category_label":"Policy & safety","importance":2,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":5,"official":0,"filed":"2026-09-29","updated":"2026-10-05","orgs":["Google","Google Threat Intelligence Group"]}],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-10-29","type":"filed","text":"Created from Symantec's report, read directly (news agent; found via the related posts of the Oct 29 relay report)"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-29","run":null,"sources_read":"Symantec's report, read directly (news agent; found via the related posts of the Oct 29 relay report)","updated":"2026-10-29","human_review":null,"version":{"date":"2026-10-29"}},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":168,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":107,"in_training_data":false},{"model_id":"gemini-4-argon","name":"Gemini 4 Argon","cutoff":"2026-03","days_after":198,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":137,"in_training_data":false}],"short_url":null}