Check Point Research published technical analysis on October 23 of a new Windows infostealer named Aokigahara, after the Japanese forest associated with death. The malware includes a purpose-built module called aisessions that explicitly harvests authentication tokens and session cookies for AI development tools and platforms.
What Aokigahara steals
The aisessions module targets active sessions for Claude, ChatGPT, OpenAI API, Cursor, and GitHub Copilot. Because these platforms rely on long-lived session tokens rather than per-request credentials, a single stolen token gives an attacker persistent access until the user manually revokes it. Developers who use AI coding assistants store significant context in their sessions, including project history, custom instructions, and uploaded files.
Beyond AI sessions, Aokigahara collects browser-stored passwords and cookies across Chrome, Edge, and Firefox; SSH private keys; AWS, Azure, and GCP credential files; cryptocurrency wallet files and seed phrase stores; and Telegram session data. Stolen data is packaged and encrypted using AES-256-GCM before transmission to command-and-control infrastructure. The malware checks the system locale and terminates without executing if it detects a Russian or CIS-region keyboard layout, a common evasion technique among financially motivated threat actors operating from those regions.
Indicators of compromise
Primary C2 endpoint: 2[.]26[.]252[.]48 port 8080. Observed C2 domains (defanged): update-manager[.]icu, cdn-assets[.]cloud, and pkg-storage[.]net. The malware drops a persistence stub at C:\Microsoft\Vault\ and creates a scheduled task named MicrosoftVaultService. YARA strings of note: "aisessions", "session_token_extractor", and the embedded mutex "Aoki_Global_Mutex_2026".
What developers should do
Block all traffic to the listed C2 IP and domains at the perimeter and on endpoint firewalls. Immediately rotate API keys for any AI platform (Claude, OpenAI, GitHub) accessible from potentially exposed developer machines. Revoke active sessions in each platform's settings rather than relying on token expiry. The infection vector is endpoint-originating, typically trojanized developer tooling or cracked IDE plugins distributed via GitHub or package registries; review recent installs on developer machines and audit npm, pip, and cargo packages added in the past 30 days.
Gigia Tsiklauri is the founder of infosec.ge. Get in touch to report a vulnerability, submit a tip, or ask about coverage.