Threat feed

Aokigahara AI-session stealer

Aokigahara infostealer: dedicated AI-assistant and developer-tool session theft with X25519/AES-GCM exfiltration

Posted · Updated · Spectrum Delta Research Team

Summary

Check Point Research (Oct 23) documents Aokigahara, a newly observed Windows infostealer in the wild whose dedicated `aisessions` handler collects authentication, session and configuration files from Claude/Claude Code, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, JetBrains AI Assistant, Kiro and more — alongside browser, Git/SSH and cloud credentials. Stolen data is packaged in AES-GCM-encrypted ZIPs with X25519-derived keys and uploaded in chunks to a /gate C2 (Check Point Research, A/3); an earlier version may have been known as Kamidere or Stygian (unconfirmed), and the initial infection method is not stated.

Breakdown

Adversary

Unknown — no named actor or group

Procedures (5)

  1. aisessions handler reads AI-tool auth/session/config files

    aisessions handler: AI-tool credential and session file collection

    • T1552.001Unsecured Credentials: Credentials In Files

    Logs

    • Sysmon / EDR · EDR file-read/access events (process-attributed) on AI/dev/SSH paths; EID 1

    Detectors

    No known detector

Click to expand remaining (4) procedures

  1. Windows Credential Manager queried by the stealer

    Windows Credential Manager queried

    • T1555.004Credentials from Password Stores: Windows Credential Manager

    Logs

    • Sysmon / EDR · EDR file-read/access events (process-attributed) on AI/dev/SSH paths; EID 1

    Detectors

    No known detector

  2. Browser saved-credential collection

    • T1555.003Credentials from Password Stores: Credentials from Web Browsers

    Logs

    • Sysmon / EDR · EDR file-read/access events (process-attributed) on AI/dev/SSH paths; EID 1

    Detectors

    No known detector

  3. SSH private-key file collection

    SSH private-key collection

    • T1552.004Unsecured Credentials: Private Keys

    Logs

    • Sysmon / EDR · EDR file-read/access events (process-attributed) on AI/dev/SSH paths; EID 1

    Detectors

    No known detector

  4. AES-GCM chunked exfiltration to /gate C2 over X25519

    X25519/AES-GCM chunked exfiltration to /gate C2

    • T1041Exfiltration Over C2 Channel

    Logs

    • Network / proxy · C2 destinations (DNS/flow); /gate paths and headers need HTTP content

    Detectors

    No known detector

Indicators of compromise

Hunt only

(Check Point Research (https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/), A/3) — C2: 2[.]26[.]252[.]48:8080, dfwioeiofwr[.]info, dobeqnesmot[.]cc, gate[.]dfwioeiofwr[.]info, hjazfioe[.]surf, kkeyyou[.]cc, neihite[.]cc, somelitersofblood[.]pw; named-pipe pattern akg_%lx_%lx; clipper SHA1 8d6c86e0af7807f9b5baf15e9f076bb81e012515 at C:\Microsoft\Vault; a large SHA1 sample block in the primary (count not stated); YARA strings. Single-origin (Check Point); the X-Build-ID/X-Gate-Token/X-Session/X-HWID values are request examples, not stable indicators — full detail in thread (the thread carries the C2 set, clipper indicator and pipe pattern; the complete path tables and SHA1 block are in the primary); assessed 2026-10-24, hunt-only.

Detailed

Full IOC detail (single-origin, Check Point): C2 — 2[.]26[.]252[.]48:8080, dfwioeiofwr[.]info, dobeqnesmot[.]cc, gate[.]dfwioeiofwr[.]info, hjazfioe[.]surf, kkeyyou[.]cc, neihite[.]cc, somelitersofblood[.]pw; up to three fallback URLs per config (not published). Example session headers (samples, not all-sample constants): X-Build-ID cae87a25 / 4dbf818f, X-Gate-Token fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e, X-Session ca47b44161834cb70a224dbe3d92a383, X-HWID 69B506A1. Clipper component SHA1 8d6c86e0af7807f9b5baf15e9f076bb81e012515 at C:\Microsoft\Vault. Named-pipe pattern \\.\pipe\akg_%lx_%lx. A large SHA1 sample list is published as a single space-separated block in the primary (count not stated). YARA strings per the exact rule in existing_product_coverage.

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of Aokigahara AI-session stealer? Bring them to the community.

Discuss in the Tradecraft Slack