Aoki Infostealer Adds AI Coding Assistant Credentials to Its Targets

Oct 15, 2026 · Original article ↗

Summary

Symantec researchers say newer Aoki infostealer samples target credentials and session files for AI coding assistants, alongside data from browsers, wallets, password managers and other apps. Stolen tokens could expose connected developer services.

Key points

Newer Aoki samples target credential and session files for services including Claude, Codex, Cursor, Codeium, Gemini, GitHub Copilot, JetBrains AI Assistant and Kiro.
Researchers say older samples did not target AI-related files, indicating the capability was added recently.
The malware also collects data from browsers, cryptocurrency wallets, messaging and gaming apps, password managers, VPNs and FTP clients.
Stolen API keys and tokens could enable activity under a developer's identity and quota, and expose linked repositories, cloud services and CI/CD pipelines.
The malware collects available data and sends it to a command-and-control server; the analyzed samples had no backdoor command list.
The researchers say the threat actor is unknown and found no indications linking Aoki to an existing malware family.

Article Details

Attack Vectors: Aoki infostealer steals AI coding assistant credentials, API keys, OAuth and session tokens, and related configuration or session files from victim machines.
The malware collects credentials and data from browsers, cryptocurrency wallets, password managers, messaging and gaming applications, VPN and FTP clients, and security products.
Aoki sends collected data to its command-and-control server using a /gate endpoint; older samples used an IP address and port 8080 over unencrypted HTTP.
Defensive Notes: Symantec reports that its Endpoint products detect and block malicious files when the file is available; the family is detected as Infostealer.Aoki.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`dobeqnesmot[.]cc`	Domain used by newer Aoki samples as command-and-control infrastructure.
DOMAIN	`hjazfioe[.]surf`	Domain used by a newer Aoki sample as command-and-control infrastructure.
DOMAIN	`neihite[.]cc`	Domain used by a newer Aoki sample as command-and-control infrastructure.
SHA256	`039240551f88b0064b2615dffdc1321b1e7c58e3f617ac138a65a6d59400b331`	File hash identified as Infostealer.Aoki.
SHA256	`07bc2e3a1d14743cc44f1dc4c78d15d0f2b458b39fb48422b13df40fc662ba21`	File hash identified as Infostealer.Aoki.
SHA256	`0adc8e83b2416c275b1283916d70568faddeb6d718eb45f9addfb0938db245b3`	File hash identified as Infostealer.Aoki.
SHA256	`0e38bd3c30a4ca08641240ce95b5b6ba593e131213ca1b2a28da4e0385fcabc4`	File hash identified as Infostealer.Aoki.
SHA256	`2fb80e2221bd304e7cd5ac04169e71807ad92d19836f1aaf7885295cb90b2d94`	File hash identified as Infostealer.Aoki.
SHA256	`36af3acc78058023cdcf9307bc15be640be9425de97e574fdaf42d03d308725b`	File hash identified as Infostealer.Aoki.
SHA256	`3b4547f0d7549274f366cd9568b3d302c1e80e1b89359da681beb47260ec7975`	File hash identified as Infostealer.Aoki.
SHA256	`6350dfee6975a9b159c5a57a3e97f757b0b02fd2dc708016fa6d7270e720c865`	File hash identified as Infostealer.Aoki.
SHA256	`6655b89b9885483d459c73f2a52e3cec121de5c5956172a8676a0f4c2de94999`	File hash identified as Infostealer.Aoki.
SHA256	`73dbac0907e8a092cd978f2787ab1994946f5da1e08f2bdbd05ea52e80cdb896`	File hash identified as Infostealer.Aoki.
SHA256	`752c8e64af60960b85cf00e4bd34eb459e24b7939464f718ec18494df43b4b69`	File hash identified as Infostealer.Aoki.
SHA256	`780bbdbb119befd4eb16e0c2ec0c64e7bedc1b53ce4f85804aea091a6e3af519`	File hash identified as Infostealer.Aoki.
SHA256	`b590235493487c51f7050b341c9b2450e4f761ad6055207e4f6daf0cecae271c`	File hash identified as Infostealer.Aoki.
SHA256	`bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf`	File hash identified as Infostealer.Aoki.
SHA256	`c533570fd7cd7eaf5478317b03ea5750d03797aa4d11ebd96555b6cb708c63f2`	File hash identified as Infostealer.Aoki.
SHA256	`e374f9ff5094f728528efa566c3de1b7fea7d95f497242a01fffa6c70b5eb768`	File hash identified as Infostealer.Aoki.
SHA256	`f779314b1a5a0b297fd4e2a5f9c1e40d387b3e7c401d42324b556a70f813840e`	File hash identified as Infostealer.Aoki.
URL	`hxxps[:]//dobeqnesmot[.]cc/gate`	Aoki command-and-control endpoint used to send collected data.
URL	`hxxps[:]//hjazfioe[.]surf/gate`	Aoki command-and-control endpoint used to send collected data.
URL	`hxxps[:]//neihite[.]cc/gate`	Aoki command-and-control endpoint used to send collected data.