New Infostealer Aokigahara Goes After AI Tools and Developer Accounts

Check Point Research has analysed an infostealer called Aokigahara. It does what many infostealers do: it captures screenshots and clipboard contents, steals browser passwords and cookies, collects cryptocurrency wallet data and grabs files. It also includes a clipper handler that drops a separate component to manipulate the clipboard. Its targets include Chromium-based browsers, Firefox, Discord, Telegram, Steam, Roblox, Minecraft, password managers, VPN clients, FTP/SFTP clients and email applications.

What sets it apart is a handler called aisessions. It goes after AI applications and development tools, including Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI. It also targets AWS credentials and single sign-on (SSO) data, along with authentication files, session data and configuration files from AI-assisted development and cloud environments.

The researchers say this points to a wider shift in what attackers may value. Valid credentials or session tokens could expose private conversations and development data, allow unauthorised use of paid services, or potentially be sold as access to compromised AI accounts. The malware's collection routines support these possibilities, but the analysis does not confirm how its operators make money from the stolen data. This summary draws only on the opening of the research, not the full report.