# symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot: Symantec: The Aoki Infostealer Now Takes Claude, Codex, Cursor, Copilot, Gemini, JetBrains AI and Kiro Credentials

> Symantec: The Aoki Infostealer Now Takes Claude, Codex, Cursor, Copilot, Gemini, JetBrains AI and Kiro Credentials is a high-severity credential theft issue in Not a software vulnerability. The listed agents are not vulnerable, an AI agent. Affected: Not a software vulnerability. The listed agents are not vulnerable; their credential, token and session files are what the malware takes from infected hosts.. It has been exploited in the wild.

- **Canonical URL:** https://catalog.anomity.ai/vuln/symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot
- **Aliases:** ti-147
- **Severity:** high
- **Attack type:** Credential theft, Malware
- **Component:** Not a software vulnerability. The listed agents are not vulnerable (AI agent)
- **Catalog entry:** https://catalog.anomity.ai/agent/cursor
- **Exploited in the wild:** yes
- **Published:** 2026-10-15
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot

## Summary

Symantec's Threat Hunter Team reported on 15 October 2026 that newer samples of the Aoki (Aokigahara) infostealer, first seen earlier in 2026, now collect credential and session files for AI coding assistants; older samples did not. The newest version takes .claude.json, Claude desktop and ChatGPT cookies, the Codex config.toml and .env files, tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, and AWS credentials, alongside data from dozens of browsers, cryptocurrency wallets, password managers and messaging, gaming, VPN and FTP clients. It takes credential, token and session files rather than source code, with one exception: Cursor's local state database, which can cache chat context and code snippets. It has no command set; it uploads whatever it finds to a /gate endpoint on its C2 servers (dobeqnesmot[.]cc, hjazfioe[.]surf, neihite[.]cc). Symantec detects it as Infostealer.Aoki and has not linked it to a known group. Stolen AI keys and tokens can be resold or used under the victim's identity and quota, and can open the way to connected repositories, cloud services and CI/CD pipelines.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Not a software vulnerability. The listed agents are not vulnerable; their credential, token and session files are what the malware takes from infected hosts. | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run Not a software vulnerability. The listed agents are not vulnerable; their credential, token and session files are what the malware takes from infected hosts..

## How do I fix it?

Block the listed C2 domains, alert on POSTs to /gate on them, and hunt for the SHA-256 hashes Symantec published. On any host where Aoki or another infostealer is found, revoke and reissue the Claude, OpenAI and Codex, Copilot, Cursor, Gemini, JetBrains AI and Kiro sessions and API keys, plus AWS and GitHub credentials, from a clean machine, and review provider usage for activity nobody initiated. Prefer short-lived, SSO-bound agent sessions to long-lived API keys in config files, and keep keys out of .env files in home directories.

## How do I find every machine running Not a software vulnerability. The listed agents are not vulnerable?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Not a software vulnerability. The listed agents are not vulnerable and which version, then enforce a policy on it.

## References

- advisory: https://www.security.com/threat-intelligence/aoki-infostealer-ai-targeting

## Related vulnerabilities

- [tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm](https://catalog.anomity.ai/vuln/tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm) — critical
- [ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf](https://catalog.anomity.ai/vuln/ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf) — high
- [CVE-2026-50548](https://catalog.anomity.ai/vuln/cve-2026-50548) — critical
- [trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace](https://catalog.anomity.ai/vuln/trojanized-claude-code-extension-2-1-313-in-cursor-s-marketplace) — critical
- [CVE-2025-54133](https://catalog.anomity.ai/vuln/cve-2025-54133) — high
- [agentjacking-public-sentry-dsn-hijacks-claude-code-cursor-codex-via-mcp](https://catalog.anomity.ai/vuln/agentjacking-public-sentry-dsn-hijacks-claude-code-cursor-codex-via-mcp) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot