Aoki infostealer adds AI coding credentials to its targets

Symantec reports that newer samples of the Aoki infostealer search for credentials and session files used by AI coding assistants. The October 15 analysis names Claude, OpenAI Codex, Cursor, Codeium, Gemini, GitHub Copilot, JetBrains AI Assistant, and Kiro. The newest sample it examined also targeted Claude and ChatGPT cookies, Codex configuration files, and AWS credentials. Earlier samples did not target AI-related files, according to the report. (Symantec threat analysis)

The report describes malware capability. It does not provide a victim count or confirm that every targeted file was present, successfully collected, or used. Symantec says the samples collect available data and send it to a command-and-control server. It reports credential, token, and session data theft rather than source-code theft, with one qualification: Cursor's local state database can contain cached chat context and code snippets. The report identifies no software vulnerability in the named assistant products and gives no actor attribution.

What exposed credentials could reach

An API key or session token can let another party act under the associated identity, consume API quota, or access connected resources within that credential's permissions. Symantec specifically flags linked repositories, cloud services, and CI/CD pipelines as potential exposure paths. That is a risk path, not evidence that a particular account or repository was accessed.

Response steps for affected teams

If endpoint evidence indicates Aoki or another infostealer ran on a developer system, start the organization's incident process. Preserve relevant endpoint, identity, and provider records. Contain the affected host and investigate it before using it to issue replacement secrets. NIST's incident response guidance treats response as part of cybersecurity risk management; the precise containment and evidence steps depend on the environment. (NIST SP 800-61 Rev. 3)

From a known-clean device, inventory assistant credentials and sessions that may have been stored on or used from the affected system. Revoke exposed API keys, personal access tokens, OAuth grants, and active sessions through the issuing provider. Create replacements only after the affected environment is contained. OpenAI advises users with suspected account compromise to log out active sessions, delete exposed API keys, review API usage and security history, and contact support. Anthropic advises immediately revoking a suspected compromised Claude API key. GitHub documents deletion of personal access tokens. (OpenAI account security; Anthropic API key response; GitHub token management)

Review sign-in and security events, API usage, repository activity, connected applications, and cloud or CI audit records for activity outside the expected user, time, location, or workflow. Prioritize credentials with broad permissions and rotate shared secrets through their owners' normal incident process. Record what the logs confirm and what remains unknown. A credential file on disk establishes possible exposure; it does not by itself establish successful theft or misuse.

Scope

The reporting establishes an expanding infostealer target list in samples analyzed by Symantec. It does not establish how many systems were affected, whether a named service was breached, or that any assistant vendor shipped vulnerable software. Treat this as a local credential theft and incident response issue, and base account-level conclusions on provider and endpoint evidence.