Aokigahara malware steals AI tool logins and cloud keys
The new malware copies login files of seven AI tools, but nobody knows how its operators use them.
Researchers found Aokigahara, a new infostealer, in the wild. An infostealer is software that steals stored data from a computer. A module named aisessions copies login files and session data of seven or more AI tools. With a token that works, an attacker can use an AI tool or a cloud account without a password.
How it works
Aokigahara also steals browser passwords, cryptocurrency wallets, VPN clients, password managers and email data. The aisessions module gets files of these AI tools:
It also gets Git credential files, SSH private keys, and AWS, Azure and Google Cloud files.
The numbers
The analysis gives no count of victims or of stolen accounts. It tells that targeted files do not always hold a secret.
What is not known
The analysis does not make sure how the operators earn money. It tells that stolen tokens can give access to paid tools, or that the operators can sell accounts. An earlier version possibly had the names Kamidere or Stygian.
Insight: Stolen AI logins have a buyer on the other side
Symantec reported on 15 October that Aoki malware gets AI tool credentials. Bitsight reports MONST3R-AI, a criminal tool that operates scans with stolen AI keys, and the owner of the keys pays. Malware supplies the keys and attack tools use them, which seems to make AI logins a currency. The sources do not connect the two. Keep an AI token as safe as cloud keys.
Sources
- Infostealer riding the AI Trainresearch.checkpoint.com
Posted
