Full Report
Newer versions of a little-documented infostealer steal API keys and tokens from ever-growing number of AI coding assistants, including Claude, Codex, Cursor and Gemini.
Analysis Summary
# Tool/Technique: Aoki (aka Aokigahara) Infostealer
## Overview
Aoki is a contemporary information-stealing malware (infostealer) designed to harvest a wide array of sensitive data from infected systems. While it functions as a traditional stealer, recent variants have specifically evolved to target API keys, tokens, and session files for AI coding assistants and development tools. By compromising these assets, attackers can gain unauthorized access to cloud services, private code repositories, and CI/CD pipelines under the guise of a legitimate developer.
## Technical Details
- **Type:** Malware family (Infostealer)
- **Platform:** Windows (Targeting desktop applications, browsers, and IDE extensions)
- **Capabilities:** Credential harvesting, session hijacking, cryptocurrency theft, system enumeration.
- **First Seen:** Early 2024 (AI-targeting capabilities identified October 2024)
## MITRE ATT&CK Mapping
- **TA0006 - Credential Access**
- **T1539 - Steal Web Session Cookie** (AI assistant and browser sessions)
- **T1552 - Unsecured Credentials** (Searching for .env, config.toml, and private keys)
- **T1555 - Credentials from Password Stores** (Browsers, VPNs, and Password Managers)
- **TA0007 - Discovery**
- **T1518.001 - Security Software Discovery** (Identifies installed security products)
- **TA0010 - Exfiltration**
- **T1041 - Exfiltration Over C2 Channel** (Data sent to /gate endpoint)
## Functionality
### Core Capabilities
- **Browser Data Theft:** Extracts cookies, autofill, credit card info, and history from over 40 browsers (Chrome, Edge, Firefox, etc.).
- **Crypto Wallet Harvesting:** Targets dozens of browser extensions (MetaMask, Coinbase) and desktop wallets (Exodus, Bitcoin Core).
- **Communication/Gaming:** Steals tokens from Discord variants and session files from Telegram and gaming platforms (Steam, Roblox, Epic).
- **Credential Recovery:** Extracts saved passwords from VPN clients, FTP clients (FileZilla), and email clients (Outlook/Thunderbird).
### Advanced Features
- **AI Coding Assistant Targeting:** Specifically harvests files like `.claude.json`, `config.toml`, and `.env` to steal tokens for Claude, Codex, Cursor, Codeium, Gemini, and GitHub Copilot.
- **Keyword Search:** Scans the filesystem for filenames containing sensitive strings like "mnemonic," "recovery," "privatekey," and "backup."
- **Cloud Service Access:** Targets AWS credentials, potentially enabling lateral movement into cloud infrastructure.
## Indicators of Compromise
- **File Hashes (SHA256):**
- `752c8e64af60960b85cf00e4bd34eb459e24b7939464f718ec18494df43b4b69`
- `bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf`
- `0adc8e83b2416c275b1283916d70568faddeb6d718eb45f9addfb0938db245b3`
- **Network Indicators:**
- `dobeqnesmot[.]cc`
- `hjazfioe[.]surf`
- `neihite[.]cc`
- `hxxps://dobeqnesmot[.]cc/gate`
- `hxxps://hjazfioe[.]surf/gate`
- **Behavioral Indicators:**
- Unauthorized access to `.config` and `.env` files in developer directories.
- Large-scale reading of browser profile directories.
- Outbound HTTP/HTTPS traffic to unknown domains using the `/gate` URI.
## Associated Threat Actors
- Currently not attributed to a specific named group; however, it is likely used by various cybercriminals via a Malware-as-a-Service (MaaS) model.
## Detection Methods
- **Signature-based:** Symantec products detect this family as `Infostealer.Aoki`.
- **Behavioral:** Monitor for processes attempting to access multiple sensitive directories (e.g., `%AppData%\Roaming\Cursor\User\globalStorage`) in rapid succession.
- **Network:** Alert on unencrypted POST requests to remote IPs on port 8080 (older versions) or specific `/gate` endpoints.
## Mitigation Strategies
- **Token Rotation:** Regularly rotate API keys and session tokens for AI assistants.
- **Environment Variable Security:** Avoid storing plain-text credentials in `.env` files; use secret management services (e.g., AWS Secrets Manager).
- **Endpoint Hardening:** Implement application whitelisting and restrict access to sensitive application data directories.
- **Multi-Factor Authentication (MFA):** Enforce non-phishable MFA for all developer accounts and GitHub/GitLab repositories.
## Related Tools/Techniques
- **RedLine Stealer:** Similar broad targeting of browsers and crypto wallets.
- **Lumma Stealer:** Comparable recent focus on browser extension exploitation.
- **Key harvesting:** Similar to techniques used in software supply chain attacks to compromise CI/CD pipelines.