The Aoki malware gets credentials of AI tools for code

A report from Symantec of October 15 shows this. New versions of Aoki get credential files of AI tools for code. The first versions get data from browsers, cryptocurrency wallets and password managers. The new versions also get credentials of Claude, Codex, Cursor and Gemini. With them, an attacker can work as the developer.

What is new

Symantec sees Aoki for the first time in 2026. The new function to get AI files grows.

What it gets

The new versions that Symantec finds get these items:

• the settings files of Claude and the Claude desktop cookies
• ChatGPT cookies
• the settings files of Codex
• tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro
• Amazon Web Services credentials

Why it matters

Symantec tells that an attacker can work with the identity and the API quota of a developer. This can go around safeguards for known users. The tokens can also give access to repositories, cloud services and pipelines.

Symantec compares an AI token to payment card data. An attacker can use the account of the victim. This is LLMjacking.

What is not known

Symantec does not know which group makes Aoki. It finds no connection to a known malware family. The data that Aoki gets shows that the attackers want money.