A Windows infostealer called Aokigahara collects AI-assistant sessions alongside the browser passwords and wallet data expected from this kind of malware. Check Point Research found collection routines for Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI. A developer who signs into those tools on a compromised workstation may also have Git, SSH and cloud credentials within the stealer’s reach.
The striking target is a local AI login. The Codex paths in the analysis include .codex\auth.json, .codex\config.toml and .codex\.env; the Claude Code paths include .claude\credentials.json and .claude.json. Check Point says it has spotted Aokigahara in the wild. On a matched host, use service logs to determine whether any exposed account was accessed.
Local sessions join familiar theft targets
Aokigahara has handlers for browser logins and cookies, Firefox profiles, screenshots, clipboard contents, messaging tokens, wallets, VPN settings and saved FTP connections. The dedicated aisessions handler reaches into AI and development applications. On Windows it looks for Cursor’s Cursor\User\globalStorage\state.vscdb and storage.json, Windsurf’s Windsurf\User\globalStorage\state.vscdb, GitHub Copilot’s .copilot\hosts.json, Gemini CLI’s .gemini\config.json, and AWS CLI files at .aws\credentials, .aws\config and .aws\sso\cache. The report writes some roots as %s because their full path depends on the Windows user or application data directory.
Another handler, ide, collects matching editor and development files, including Git credential files, .ssh files that may contain private keys, and AWS, Azure and Google Cloud credential or configuration files. A stolen AI session may expose a paid service or private conversation; usable repository or cloud credentials can open the systems used to build and deploy software. Check Point cautions that “not every targeted file necessarily contains authentication secrets.” Start with the account and file inventory of a matched workstation rather than assuming every named application leaked a working token.
Encrypted uploads carry separate collections
The stealer’s configuration selects which embedded handlers run through a module_mask bitmask. Each enabled collection module packages its output into a ZIP archive. After an X25519 key exchange, the malware encrypts archive contents with AES-256-GCM and sends them to /gate/chunk; the X-Chunk header labels the collection, including aisessions for the AI-tool data. /gate/handshake starts the session and /gate/complete ends the upload phase. An enabled handler and a completed upload are different observations: investigation needs the host and network record for the affected system.
Check Point lists 2[.]26[.]252[.]48:8080 as Aokigahara command-and-control infrastructure and also lists gate[.]dfwioeiofwr[.]info. Its analyzed samples use Microsoft-CryptoAPI/10.0 as the HTTP user agent; the researchers observed changes to that string across versions. For a concrete host pivot, one listed SHA-1 is 007137599bc4d69ee952a5228b5fcb2c3b9a95a7. Search endpoint detections or retained file hashes for that sample, then correlate the host’s proxy, firewall or EDR network events with those defanged destinations and the /gate/handshake, /gate/chunk and /gate/complete paths. Treat an application’s local credential file as exposure context, not as a malware detection by itself.
Rotate access from a clean device
When an endpoint or network match identifies an affected Windows workstation, isolate it and preserve the relevant process, file and connection evidence. Scope the locally used AI accounts, Git and SSH identities, and cloud profiles before issuing replacements from a clean machine. Invalidate potentially exposed AI and developer sessions with the relevant service administrators. Review the services’ access history for use after the suspected exposure window, particularly repositories and cloud resources reachable by those identities.
For long-lived AWS access keys present on that machine, AWS recommends reviewing and updating keys and using CloudTrail to monitor their use. Replace affected keys, confirm each old key is inactive in IAM, and review its CloudTrail usage during the exposure window while the replacement serves the intended workload. AWS notes that the shared credentials file stores access-key material in plaintext; a workstation image of .aws\credentials therefore deserves the same care as the key itself.
For potentially exposed GitHub tokens, GitHub documents credential revocation: a revoked token stops authenticating Git and API requests. Check the account’s security log for oauth_authorization.destroy when applicable, and review repository access during the exposure window. Rotate affected SSH keys through the services that accept them as well. These steps change the authority a stolen file might carry; a password reset alone leaves separate sessions, access keys and SSH keys to account for.
Match the host, then retire access
Take the malware hash and infrastructure pivots to your endpoint and network telemetry, and tie a hit to a specific workstation. Use that machine’s installed applications and credential locations to prioritize session invalidation and key replacement. Confirm revocation in the service’s own authentication and activity records, not by inspecting the now-isolated workstation alone. A developer machine holding both AI sessions and cloud credentials deserves the same response scope as a compromised build workstation: the services those credentials can reach are part of the incident.