INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Aoki's Infostealer Targets AI Coding Assistant Credentials and Login Details

| 2026-10-15 10:56 LOW MEDIUM DATA BREACH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
On October 15, 2026, a new infostealer targeting AI coding assistants was discovered, specifically affecting versions of Claude, Codex, Cursor and Gemini. Aoki, the identified entity behind this attack, utilizes T1589.001 - Credentials as its MITRE ATT&CK Technique. The attackers have been stealing API keys and tokens from these popular AI coding assistants, compromising their security. This infostealer has been targeting a growing number of users, with no specific numbers provided in the source article. As of now, there is limited information available on how this attack works or its current status beyond the initial discovery.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 22 IoCs Create Free Account
hxxp://••••••••••••••••••••
73dbac••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
f77931••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
780bbd••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
6350df••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
ne•••••.cc
do•••••.cc
ww•••••.com
hj•••••.surf
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎2026/10/15
Threat actors using the Aoki infostealer exploited vulnerabilities in AI coding assistant credentials on October 15, 2026.
organisation Aoki
Aoki: Infostealer Targets AI Coding Assistant Credentials.
Intelligence Sources
AlienVault OTX 2026-10-15