AI account sessions are among the data sought by Aokigahara, a Windows information-stealing malware discovered by Check Point Software researchers. Alongside passwords and financial data, it collects files tied to AI assistants and coding tools, potentially putting paid services, confidential conversations and development resources within attackers’ reach.
Dark Reading, reporting on Check Point’s findings, identified Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot and Gemini CLI among the targets. The collection includes authentication files, session data and configuration files associated with those tools.
The significance depends on what the stolen access permits. Check Point said credentials and session tokens could let attackers use paid AI services without authorization or sell compromised accounts. Where that access also opens conversation histories or uploaded files, confidential business material and proprietary source code could become grounds for an extortion demand. The report describes that possibility, rather than documenting an extortion incident involving Aokigahara.
From local files to wider access
After an infection begins, Aokigahara searches the computer for browser passwords, session cookies, cryptocurrency wallets and AI application credentials. It examines local application files for authentication tokens, API keys and other sensitive material. Its broader targets include VPN clients, FTP/SFTP clients, password managers and email applications.
The collection also reaches into software development and cloud administration: Git access data, SSH private keys, and credential and configuration files for AWS, Azure and Google Cloud. According to Check Point, those credentials could open private code repositories or cloud resources, provided they are still valid and carry sufficient permissions. Finding a credential on a compromised machine does not establish that an attacker successfully used it.
Denis Calderone, chief technology officer at Suzu Labs, told Dark Reading that the combination gives stolen AI sessions potential value for both account resale and extortion. He also highlighted how the theft of AI sessions, repository credentials and cloud files from one workstation can expose several parts of an organization’s development environment.
Aokigahara checks for virtual machines and sandboxes used to analyze malware. The report also describes a transfer process in which collected data is placed in zip archives, encrypted and sent to servers controlled by attackers.
What a compromise review should cover
For a suspected endpoint compromise, Check Point recommends examining AI sessions, API keys, GitHub credentials, SSH keys and cloud tokens alongside browser passwords. Revoking exposed sessions and rotating secrets addresses the different forms of access that may have been collected.
Dark Reading’s defensive guidance also calls for investigating suspicious reads of AI applications’ local storage and authentication files. It recommends protecting AI authentication data as enterprise secrets, limiting long-lived developer and cloud secrets on endpoints, using managed identity and short-lived credentials where feasible, and restricting repository and cloud access.
