New malware targets AI platforms

Check Point Research has identified a new infostealer called Aokigahara, designed to steal identifiers and session tokens from AI platforms like Claude, ChatGPT, and GitHub Copilot. The malware also targets cloud access and developer secrets, making it a significant threat to both individuals and organizations.

Aokigahara's methods and capabilities

Aokigahara scans cookies, passwords stored in browsers, and cryptocurrency wallets, and it has expanded its targets to include AI accounts. It specifically focuses on session tokens, which are digital keys that keep users logged in without requiring a password. Once stolen, these tokens can be used to access the associated accounts.

Comparison to other infostealers

Infostealers like Aokigahara are not new, with other well-known examples including Lumma Stealer, Vidar, Agent Tesla, and Raccoon Stealer. These programs typically search and collect valuable data once installed on a machine. Aokigahara stands out with its "aisessions" module, which is dedicated to artificial intelligence tools.

Scope of Aokigahara's targets

The malware targets platforms such as Claude, ChatGPT Desktop, Codex, GitHub Copilot, Gemini CLI, Cursor, and Windsurf. It searches for authentication files, tokens, and configuration data. These tokens function like festival bracelets, allowing access without repeatedly presenting credentials. Once stolen, attackers can access conversation history, uploaded documents, code, or confidential company information.

Additional targets and security concerns

Aokigahara also targets Git identifiers, which grant access to code repositories, and searches files related to SSH, Git, AWS, Azure, and Google Cloud identifiers and configurations. It also targets software such as VS Code or JetBrains tools. Check Point notes that the AI and development aspects function as separate modules, with no evidence that hackers link them in a single attack.

Expert advice on protection

According to Eli Smadja, head of research at Check Point Research, attackers follow users to where they work. AI sessions are now considered sensitive accesses, on par with a cloud account. Protecting what is entrusted to a chatbot only solves part of the problem. Users must also protect the tokens that provide access and, once a device is compromised, review AI sessions as they would browser or cloud accesses. Your chatbot now deserves a lock.