Aoki Infostealer Targets AI Coding Credentials

A new infostealer called Aoki has been updated to target the credential files your AI coding tools store locally. The October 2026 variant goes after Claude, Cursor, GitHub Copilot, OpenAI Codex, Gemini, JetBrains AI Assistant, and Kiro — basically the entire AI dev toolchain. Symantec published the finding on October 15. If those tools are on your machine, so are the files Aoki wants.

What Changed: Aoki Now Targets AI Coding Tools

Earlier versions of Aoki focused on browsers, cryptocurrency wallets, and password managers — the standard infostealer playbook. The new variant keeps all of that and adds a dedicated AI credential harvesting module on top. Symantec notes the malware has “no links to existing malware families” and the responsible group hasn’t been identified — but the targeting shift tells you everything about where attacker attention has moved in 2026.

The malware runs as a Windows executable, gathers credentials from local files, and exfiltrates them to command infrastructure via a /gate endpoint. No interactive backdoor. It reads, packs, and sends.

The Exact Files at Risk

Here is what Aoki is specifically looking for on your machine:

• ~/.claude/.credentials.json — OAuth access token and long-lived refresh token
• ~/.claude.json — MCP server configurations and plugin secrets
• ~/.codex/auth.json and ~/.codex/config.toml
• .env files in project directories containing API key patterns (sk-, ghp_, github_pat_)
• Cursor’s local state database
• JetBrains AI Assistant and Kiro credential stores
• AWS credentials

The most dangerous file is ~/.claude/.credentials.json. It doesn’t just hold an API key — it holds the OAuth refresh token. A single read of that token gives an attacker standing account access, not just one-time key use. And ~/.claude.json is the underreported risk here: it contains your MCP server configs, which can include tokens for connected repositories, cloud services, and CI/CD pipelines. Rotating the API key isn’t enough if that file is also compromised.

What Attackers Do With AI Credentials: LLMjacking

This practice has a name: LLMjacking. The attacker uses your stolen credentials to run AI inference under your identity — you pay the bill, they get the compute. The numbers are stark: one stolen API key generated an $82,000 Gemini bill in 48 hours. The daily exposure ceiling for frontier model access can exceed $100,000. A stolen credential sells on dark web markets for as little as $30, then resells at 97% below market rate to buyers who burn through your quota.

It has gotten more sophisticated. Sysdig documented an exploitation framework called VAPT in June 2026 that uses hijacked LLM inference capacity as its reasoning engine — running vulnerability scanning, exploit synthesis, and attack sequencing without human input. Your stolen compute becomes someone else’s attack infrastructure. The Cloud Security Alliance confirmed that LLMjacking has evolved from opportunistic cost-shifting into a foundational attack primitive.

The scale tells the story: Sysdig tracked a 376% increase in credential theft targeting AI services between Q4 2025 and Q1 2026. Symantec’s assessment puts AI credentials on par with payment card data in value to attackers.

Audit Your Machine Now

Two commands. Run them:

# Check if vulnerable credential files exist
ls -l ~/.claude/.credentials.json ~/.codex/auth.json 2>/dev/null

# Scan for plaintext API key patterns in AI config files
grep -nE 'Bearer |sk-|ghp_|github_pat_|_KEY|_TOKEN' \
  ~/.claude.json ~/.codex/config.toml 2>/dev/null

If those files exist and contain tokens, they are targetable. If the second command returns output, those strings are sitting in plaintext on your machine. The DEV Community guide by Gabriel Anhaia walks through what each file typically contains if you want to understand your exposure in detail.

How to Harden Against Aoki

In order of priority:

1. Rotate all AI API keys now — Claude, OpenAI, GitHub, AWS, Gemini. Do this through each vendor’s console, not just locally.
2. Switch to OS keyring storage — For Codex, set cli_auth_credentials_store = "keyring" in your config. On macOS, Claude Code uses Keychain by default unless you’re in an SSH session — in that case, credentials fall back to the plaintext file.
3. Use variable references, not literal tokens in MCP configs and .env files. Reference a secret manager or keyring, not a pasted value.
4. Sign out and back in after rotation to force a credential refresh.
5. Add pre-commit hooks — detect-secrets or gitleaks catch accidental key commits before they hit your repo.
6. Rotate every 60-90 days as standard hygiene, not just in response to incidents.

This Is Not the Last Version of Aoki

Symantec describes Aoki as “still in active development.” The current list of targeted AI tools will grow. The pattern mirrors how infostealers evolved to target cryptocurrency wallets in 2021-2022 — the attacker community identified a high-value credential type and rewrote their tooling to go after it. AI credentials are that credential type now.

The countermeasure isn’t panic — it’s treating your AI coding tool tokens with the same discipline you apply to production credentials. Most developers wouldn’t commit an AWS secret key to a public repo. The ~/.claude.json file sitting in your home directory deserves the same respect.