{
  "entry": {
    "kind": "vuln",
    "slug": "symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot",
    "name": "symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot",
    "vendor": "Not a software vulnerability. The listed agents are not vulnerable",
    "description": "Symantec's Threat Hunter Team reported on 15 October 2026 that newer samples of the Aoki (Aokigahara) infostealer, first seen earlier in 2026, now collect credential and session files for AI coding assistants; older samples did not. The newest version takes .claude.json, Claude desktop and ChatGPT cookies, the Codex config.toml and .env files, tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, and AWS credentials, alongside data from dozens of browsers, cryptocurrency wallets, password managers and messaging, gaming, VPN and FTP clients. It takes credential, token and session files rather than source code, with one exception: Cursor's local state database, which can cache chat context and code snippets. It has no command set; it uploads whatever it finds to a /gate endpoint on its C2 servers (dobeqnesmot[.]cc, hjazfioe[.]surf, neihite[.]cc). Symantec detects it as Infostealer.Aoki and has not linked it to a known group. Stolen AI keys and tokens can be resold or used under the victim's identity and quota, and can open the way to connected repositories, cloud services and CI/CD pipelines.",
    "website": "https://www.security.com/threat-intelligence/aoki-infostealer-ai-targeting",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-10-15",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot",
      "aliases": [
        "ti-147"
      ],
      "title": "Symantec: The Aoki Infostealer Now Takes Claude, Codex, Cursor, Copilot, Gemini, JetBrains AI and Kiro Credentials",
      "summary": "Symantec's Threat Hunter Team reported on 15 October 2026 that newer samples of the Aoki (Aokigahara) infostealer, first seen earlier in 2026, now collect credential and session files for AI coding assistants; older samples did not. The newest version takes .claude.json, Claude desktop and ChatGPT cookies, the Codex config.toml and .env files, tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, and AWS credentials, alongside data from dozens of browsers, cryptocurrency wallets, password managers and messaging, gaming, VPN and FTP clients. It takes credential, token and session files rather than source code, with one exception: Cursor's local state database, which can cache chat context and code snippets. It has no command set; it uploads whatever it finds to a /gate endpoint on its C2 servers (dobeqnesmot[.]cc, hjazfioe[.]surf, neihite[.]cc). Symantec detects it as Infostealer.Aoki and has not linked it to a known group. Stolen AI keys and tokens can be resold or used under the victim's identity and quota, and can open the way to connected repositories, cloud services and CI/CD pipelines.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Credential theft",
        "Malware"
      ],
      "componentType": "agent",
      "component": {
        "name": "Not a software vulnerability. The listed agents are not vulnerable",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": "agent/cursor"
      },
      "affected": [
        {
          "range": "Not a software vulnerability. The listed agents are not vulnerable; their credential, token and session files are what the malware takes from infected hosts.",
          "fixed": null
        }
      ],
      "exploited": true,
      "exploitPublic": false,
      "publishedAt": "2026-10-15",
      "modifiedAt": "2026-10-15",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "advisory",
          "url": "https://www.security.com/threat-intelligence/aoki-infostealer-ai-targeting"
        }
      ],
      "mitigation": "Block the listed C2 domains, alert on POSTs to /gate on them, and hunt for the SHA-256 hashes Symantec published. On any host where Aoki or another infostealer is found, revoke and reissue the Claude, OpenAI and Codex, Copilot, Cursor, Gemini, JetBrains AI and Kiro sessions and API keys, plus AWS and GitHub credentials, from a clean machine, and review provider usage for activity nobody initiated. Prefer short-lived, SSO-bound agent sessions to long-lived API keys in config files, and keep keys out of .env files in home directories.",
      "detectedByAnomity": true
    }
  }
}