INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Aoki's Infostealer Targets AI Coding Assistant Credentials and Login Details

| 2026-10-15 12:11 MEDIUM MEDIUM DATA BREACH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
The Aoki infostealer, a malware family that has evolved to target credentials from AI coding assistants including Claude, OpenAI's Codex, Cursor, Codeium and Gemini, was detected on October 15, 2026. This capability represents a recent addition, as earlier versions did not target AI-related files. The malware steals API keys, tokens and session files that could enable attackers to conduct activities under legitimate user identities, access connected repositories, cloud services and CI/CD pipelines. Beyond AI credentials, Aoki harvests data from dozens of browsers, cryptocurrency wallets, password managers, messaging applications, gaming platforms, VPN and FTP clients. The malware collects available data and transmits it to command-and-control servers, suggesting that AI credentials are becoming as valuable as traditional targets like payment card data and cryptocurrency wallets for cybercriminals.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 22 IoCs Create Free Account
hxxp://••••••••••••••••••••
73dbac••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
f77931••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
780bbd••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
6350df••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
ne•••••.cc
do•••••.cc
ww•••••.com
hj•••••.surf
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope financefinance cryptocurrencycryptocurrency
Incident Timeline
‎2026/10/15
The Aoki infostealer has evolved to target credentials from AI coding assistants, including Claude, OpenAI's Codex, Cursor, Codeium and Gemini.
infrastructure Cursor
The Aoki infostealer has evolved to target credentials from AI coding assistants including Claude, OpenAI's Codex, Cursor, Codeium and Gemini.
organisation Claude
The Aoki infostealer has evolved to target credentials from AI coding assistants including Claude, OpenAI's Codex, Cursor, Codeium and Gemini.
organisation Aoki
Aoki: Infostealer Targets AI Coding Assistant Credentials.
organisation API
The malware steals API keys, tokens and session files that could enable attackers to conduct activities under legitimate user identities, access connected repositories, cloud services and CI/CD pipelines.
organisation CI
The malware steals API keys, tokens and session files that could enable attackers to conduct activities under legitimate user identities, access connected repositories, cloud services and CI/CD pipelines.
organisation FTP
Beyond AI credentials, Aoki harvests data from dozens of browsers, cryptocurrency wallets, password managers, messaging applications, gaming platforms, VPN and FTP clients.
Tactical Metrics
Metrics
infrastructure
‎Cursor
Affected Product
The Aoki infostealer has evolved to target credentials from AI coding assistants including Claude, OpenAI's Codex, Cursor, Codeium and Gemini.
Intelligence Sources
AlienVault OTX 2026-10-15