Aoki

Aoki, also known as Aokigahara, is a Windows information stealer that harvests locally stored credentials, authentication tokens, session cookies, and application data. Observed samples are compiled in Go. Its collection targets include browsers, cryptocurrency wallets and extensions, password managers, messaging clients, gaming platforms, email applications, VPN clients, and file-transfer software. It also captures screenshots and clipboard contents, searches for wallet recovery material and private keys, and inventories installed security products.

Newer versions add dedicated collection of AI application credentials and sessions, targeting ChatGPT, Claude Code and Claude Desktop, OpenAI Codex, Cursor, Codeium, Gemini, GitHub Copilot, JetBrains AI Assistant, Amazon Q, and Kiro. Aoki collects authentication and configuration files, API keys, OAuth tokens, and embedded-browser cookies. Developer-focused collection also covers Git credentials, SSH material, and AWS, Azure, and Google Cloud configuration data. Reusable stolen sessions can enable account access without a fresh password or multifactor authentication challenge. These capabilities involve theft from compromised endpoints, not demonstrated vulnerabilities in the targeted AI services.

Aoki supports configurable anti-analysis checks for debuggers, virtual machines, hardware resources, process counts, and mouse movement, and can terminate according to keyboard or interface-language exclusions. It encrypts its configuration with AES-256-CBC, packages stolen information into ZIP archives, and supports encrypted uploads using AES-256-GCM with X25519 key exchange. Analyzed samples collect and transmit available data rather than exposing an interactive backdoor command set.

No named threat actor or specific industry targeting has been established, and its primary delivery vector remains unconfirmed. Its expanding AI collection makes developer environments a significant area of exposure, although downstream repository compromise, account resale, and unauthorized paid AI usage have not been confirmed as operator activities.