INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).
Aoki's AI Coding Assistant Credentials Compromised by Infostealer Attack
Executive Summary
AI-generated
The Aoki infostealer has begun stealing credentials for AI coding assistants, specifically targeting OpenAI's Codex and other related services. The attack is attributed to IOC - Aoki, an infostealer designed to harvest credential and session files alongside browser, cryptocurrency wallet, and password manager data. Cryptocurrency was the targeted sector of this incident. The affected product was Cursor, a service used by Claude, which is also identified as the entity behind the attack. This attack utilizes the T1589.001 - Credentials MITRE ATT&CK Technique to steal sensitive information. As of now, no further details are available on the current status or extent of the impact caused by this incident.
Technical Mitigations AI-generated
• Analyze and patch versions of Aoki (aka Aokigahara) infostealer that target credentials for AI coding assistants, specifically Claude, OpenAI's Codex, Cursor, Codeium, and Gemini.
• Implement a detection technique to identify the <a href="/auth/login?next=/detail/Pjo-Q6EBDYL3N98kPSCD" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN • LOGIN REQUIRED]</span></a> C2 domain used by Aoki in its network traffic indicators of compromise (IOCs).
• Block or hunt for the <a href="/auth/login?next=/detail/Pjo-Q6EBDYL3N98kPSCD" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN • LOGIN REQUIRED]</span></a> IP address associated with Aoki's malicious activities.
• Use a technique to detect and prevent the use of infostealers that harvest credential and session files for AI coding assistants, such as those designed by Symantec Threat Hunter team.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected
Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.
hxxp://••••••••••••••••••••
73dbac••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
f77931••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
780bbd••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
6350df••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
ne•••••.cc
do•••••.cc
ww•••••.com
c1bc62••••••••••••••••••••••••••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
Tactical Metrics
Intelligence Sources
AlienVault OTX
2026-10-16