Aoki Malware Now Targets AI Coding Tool Tokens: What Claude, Codex and Cursor Users Should Lock Down

New versions of the Aoki information-stealing malware are targeting the credential and session files used by AI coding assistants, according to research from Symantec. Earlier Aoki builds went after browsers, cryptocurrency wallets, and password managers. The new builds add files and tokens for Claude, ChatGPT, Codex, GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant, Kiro, and AWS. For developers, that turns the configuration files many tutorials tell them to create into a target.

This article explains what the malware looks for, why AI credentials are valuable to attackers, and the steps developers and IT teams can take to reduce exposure.

What Aoki now targets

SC Media’s October 16 brief, based on Symantec’s findings and earlier reporting by Infosecurity Magazine, lists the specific files and tokens:

Product or service	What the malware looks for
Claude	.claude.json, Claude desktop cookies
ChatGPT	Browser and app cookies
Codex	config.toml and .env files
GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant, Kiro	Access tokens
AWS	Credentials

Session cookies are especially important: if a desktop app is logged in, the stealer does not need the user to type a key anywhere. It can read the session from the profile on disk.

Symantec’s assessment, as quoted by SC Media, is that AI credentials have become as valuable to thieves as payment cards and crypto wallets.

Why AI credentials are worth stealing

SC Media notes that stolen tokens let attackers work under a legitimate developer’s identity and API quota, and can expose connected repositories, cloud services, and CI/CD pipelines. That means a single theft can cause three kinds of loss:

1. Spending. Attackers consume the victim’s API quota, which can mean significant charges.
2. Identity. Actions and code changes appear to come from a trusted developer.
3. Access. Coding assistants often have permission to read private repositories, and the same machine frequently holds cloud credentials.

The inclusion of AWS credentials alongside AI tokens matters. A developer laptop that talks to AI models often also talks to cloud infrastructure, and secrets placed in a project’s .env file for an agent’s convenience may give an attacker far more than model access. A stolen editor session for Cursor or Copilot is not just a copy of chat history; it can be a way into the code the assistant can already see.

More approved tools, more credential files

The trend is likely to grow as organizations add AI assistants. Politico reported on October 15 that the US Senate was expected to add Claude for staff, who already had access to Microsoft Copilot, ChatGPT, and Gemini. Senate Sergeant at Arms Jennifer Hemingway described those tools and an internal AI working group in April testimony, and both the House Chief Administrative Officer and the Senate Sergeant at Arms have issued internal guidance for official use.

The Politico story is not about malware, but it illustrates the pattern: each newly approved assistant adds another login, another profile directory, and another set of tokens on staff machines. Usage guidance helps people use tools appropriately, but it does not protect the files those tools create. The more widely a handful of assistants are adopted, the more attractive their default file locations become to malware authors.

How to reduce exposure

For individual developers

• Find the files. Search your machine for .claude.json, Codex config.toml, and .env files. If they contain live keys, rotate those keys, then stop storing keys there.
• Use a keychain or secrets manager. Store API keys in the operating system keychain or a dedicated secrets manager. Keep config.toml for non-secret settings only. If a tool requires a key in a file to start, use a wrapper that injects it from the environment at launch.
• Keep cloud keys off the assistant’s machine where possible. If an agent needs access to cloud storage, give it a narrowly scoped role with short-lived credentials rather than long-term AWS keys in a project file.
• Log out on shared machines. Desktop and browser sessions for Claude and ChatGPT are in the target list, so a shared lab machine with an open session is an open credential.
• Turn on full-disk encryption. It protects stored files when the machine is off or lost, though not against malware running while you are logged in.

For IT and security teams

• Inventory by installed software, not by conversation. Developers who never mention Claude may still have JetBrains or Cursor tokens on disk. Check which assistant apps are installed.
• Issue per-user, per-project keys. A shared organization-wide key on one laptop means a single infection can exhaust quota and expose access for everyone. Separate keys limit the damage and make misuse easier to trace.
• Rotate on a schedule. Assume any developer machine might be compromised at some point, and rotate AI and cloud credentials regularly rather than only after an incident.
• Set spending alerts. Usage alerts on AI provider accounts can reveal stolen keys quickly.
• Control app updates. Pin and review updates for desktop assistant apps and plugins. Our coverage of plugin supply-chain attacks on AI coding agents shows how new attack paths can arrive through automatic updates.
• Treat every platform as in scope. The file names look like macOS and Windows app data, but any machine running these assistants should be considered at risk until Symantec says otherwise.

Why guidance documents are not enough

Many organizations respond to new AI tools by publishing usage guidance. That is useful for setting expectations about data and acceptable use, but it does not change where credentials are stored or how often they are rotated. The Aoki findings are a reminder that the most practical controls are technical: where secrets live, how narrowly they are scoped, and how quickly a stolen one stops working.

Related coverage

For more on AI tool security, see our articles on Codex cloud environments, the OpenCode breach and Claude Duet, and unsanctioned AI agents in the workplace.

Bottom line

Aoki’s new target list shows that attackers now see AI coding assistants as a route to money, identity, and source code. The files they look for (.claude.json, Codex config.toml and .env, desktop cookies, and editor tokens) are created by normal use of these tools. The most effective defenses are straightforward: keep keys out of plain files, scope and rotate credentials, separate cloud access from assistant access, and log out of shared machines.

Sources

• SC Media, “New infostealer targets AI coding assistant credentials” (October 16): https://www.scworld.com/brief/new-infostealer-targets-ai-coding-assistant-credentials
• Politico, “Senate to add Claude for staffers” (October 15): https://www.politico.com/news/2026/10/15/senate-add-claude-staffers-ai-01122420