Symantec’s Threat Hunter Team has reported that new versions of the Aoki infostealer now target credential and session files belonging to AI coding assistants. The report, published October 15, describes malware that earlier in 2026 focused on browser, crypto-wallet and password-manager data and has since widened its list of targets to the tools developers use to write code with AI.
The Newest Aoki Sample Targets Seven Families of AI Tools and AWS
According to Symantec, the newest sample takes the .claude.json file, Claude desktop cookies, ChatGPT cookies, and Codex config.toml and .env files. It also collects tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro, along with AWS credentials. The affected developer base covers users of Claude, Codex, Cursor, Gemini, GitHub Copilot, JetBrains AI Assistant and Kiro.
From Browser and Wallet Theft to AI Credentials
Earlier Aoki versions concentrated on browser data, crypto wallets and password managers. The addition of AI tool files shows a shift in what the malware’s operators consider worth stealing. Symantec notes that development of the malware is ongoing.
LLMjacking: What Stolen AI Keys Allow
Stolen keys let an attacker act under a developer’s identity and consume that developer’s API quota, a practice referred to as LLMjacking. The credentials can also expose connected repositories, cloud services and CI/CD pipelines, because AI coding assistants are typically configured with access to the projects and infrastructure a developer works on.
AI Credentials Treated as Valuable as Payment Cards and Wallets
The assessment in the report is that AI credentials are now valued like payment cards and crypto wallets. They can be resold or used directly, and they give an attacker a path into wider developer environments. The AWS credentials in the sample extend that path from the developer’s AI accounts to their cloud infrastructure.
Which Files and Tokens the Sample Collects
The list of stolen items is specific. For Claude, the sample takes the .claude.json file and Claude desktop cookies. For OpenAI’s tools, it takes ChatGPT cookies and the Codex config.toml and .env files. It also takes tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro, and AWS credentials. Each of these gives an attacker a different kind of access, from session cookies that impersonate a logged-in user to configuration files that can hold keys for connected services.
Attribution and Scale Remain Unknown
Symantec does not know which group is behind Aoki and sees no link to existing malware families. The report does not give victim counts. The malware was first observed earlier in 2026, and the company’s findings describe the newest sample rather than the full history of the family.
The absence of attribution leaves open who is using the stolen keys and how. LLMjacking costs fall on the account holder, whose quota and billing are consumed, and the repository and cloud exposure described in the report affects the organizations that employ the developer.
What the Report Recommends
Because Aoki is malware, the response differs from a software flaw: there is nothing for a vendor to patch, and the guidance centers on the credentials themselves.
No vendor patch applies to this threat, since it is malware on a developer’s machine rather than a flaw in a product. Symantec’s report recommends protecting and rotating AI tool credentials, though the details of that guidance were not given in the coverage of the report.
Rotation matters here because files like .claude.json and .env hold long-lived values. A credential copied by an infostealer remains usable after the malware is removed unless the underlying token or key is replaced, so a developer who suspects exposure has to treat each listed tool and the AWS account as separately compromised.
