Symantec reported on October 15 that recent samples of the Aoki infostealer now hunt a victim's machine for the credential files of AI coding assistants. API keys and session tokens have become prime loot, alongside payment cards and crypto wallets.
According to Symantec's Threat Hunter team, as cited by Infosecurity Magazine and other outlets, Aoki (also called Aokigahara) first surfaced earlier in 2026 and focused on browsers, crypto wallets, and password managers. The latest sample adds a list of targets from the developer AI ecosystem.
There are minor discrepancies between outlets (for example, some also list Codeium); here we stick to the items that agree across the sources reviewed.
Aoki does not exploit a flaw in Claude, OpenAI, or Cursor. It behaves like any infostealer: once it runs on a compromised machine, it walks known paths, bundles up anything valuable, and ships it to an attacker's server. Symantec stresses that these are credentials taken from infected endpoints, not a breach at the AI providers. What's new is what it hunts for: config files where developer tools store keys, OAuth tokens, and sessions, plus Cursor's local state database, which can also hold chat context and code snippets.
With a stolen key or token, an attacker operates under the developer's identity and burns through their API quota (the practice known as LLMjacking, which can be resold or used directly). Depending on permissions and integrations, the same material can open repositories, cloud services, and CI/CD pipelines. Symantec compares the value of these credentials to that of card data and crypto wallets.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel