A newly identified Windows information-stealing malware, named Aokigahara, is targeting login credentials, authentication tokens and session data stored by popular artificial intelligence applications, including ChatGPT, Claude, Codex and Cursor. Cybersecurity researchers at Check Point identified the malware in active circulation and detailed its capabilities in an October 23 research report.
The malware targets information stored locally on infected computers rather than exploiting confirmed security breaches in the AI platforms themselves.
How Does Aokigahara Target AI Applications?
Aokigahara contains a specialised collection module called `aisessions`, designed to search authentication files and application storage associated with AI-powered tools.
Its targets include Claude Code, Claude Desktop, Codex, ChatGPT Desktop, Cursor, Windsurf, GitHub Copilot, Gemini CLI, JetBrains AI Assistant, Amazon Q and Kiro. Researchers said the malware also queries Windows Credential Manager for stored credentials.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
What Information Can the Malware Steal?
The malware searches Claude credential files, Codex authentication and configuration files, Cursor storage databases and ChatGPT Desktop application caches.
These locations may contain authentication tokens or other sensitive information that could enable unauthorised account access. Valid session tokens could potentially allow attackers to access accounts without entering passwords again, exposing private conversations, uploaded documents and development information.
Are Cloud Credentials Also at Risk?
A separate collection module targets Git credentials, SSH files containing private keys and configuration data associated with AWS, Microsoft Azure and Google Cloud.
Beyond AI applications, Aokigahara can collect browser credentials, cookies, cryptocurrency wallet information, screenshots, clipboard contents and data from messaging, VPN and email applications. Researchers noted that the malware may have previously been known as Kamidere or Stygian.
How Does Aokigahara Avoid Detection?
The malware includes optional checks for debugging tools, virtual machines, hardware characteristics and mouse activity to complicate security analysis.
It can also terminate execution when certain language settings are detected, including Russian and Ukrainian. Its configuration uses AES-256-CBC encryption, while collected information is packaged into ZIP archives before encrypted transmission using AES-256-GCM.
What Are the Potential Consequences?
Researchers warned that stolen authentication information could enable account compromise, unauthorised use of paid AI services and exposure of confidential business material. However, these remain potential consequences. The researchers have not confirmed that Aokigahara’s operators carried out such activities.
The420 Insight: What Does This Mean?
Aokigahara highlights a growing security risk involving credentials stored by desktop AI applications and developer tools. The findings demonstrate that attackers may obtain access to sensitive AI accounts by compromising users’ computers, without directly breaching the platforms providing those services.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
