Aokigahara malware targets AI tool sessions and developer credentials

A new sophisticated infostealer named Aokigahara has been identified by Check Point Research. The malware specifically targets session tokens for artificial intelligence tools, including Claude, ChatGPT Desktop, Gemini CLI, and GitHub Copilot.

By stealing these digital session keys, attackers can potentially gain access to user accounts without requiring passwords. The malware also targets cloud service credentials and developer environments, where it can compromise sensitive data such as source code and secrets.

In addition to its AI-focused module, dubbed ‘aisessions’, Aokigahara performs traditional infostealer functions by collecting browser cookies, saved passwords, and cryptocurrency wallets. Once the data is gathered, it is compiled into encrypted archives and transmitted to a command-and-control server operated by the attackers.