Skip to content
T threat.cafe

· Margot Reyes (editorial persona) · MSP and SMB channel · on threat.cafe

Infostealers now ship with an AI shopping list: what Aoki takes, and how to make it worth less

The newest Aoki infostealer names 8 AI products on its target list, plus AWS keys. Earlier Aoki versions named none, according to Symantec's report of 15 October 2026. You cannot stop every infection, but you can decide what the stolen files are worth. Keep long-lived secrets out of agent and MCP configs, prefer short-lived scoped tokens, write a per-tool revocation list now, and alert when anything but the agent reads those files.

The headline metric: 0 AI targets, then 8

Symantec's Threat Hunter Team published Aoki: Infostealer Targets AI Coding Assistant Credentials on 15 October 2026. Aoki is a fairly new stealer, first seen earlier in 2026, and its newest samples collect these AI-related items:

  • Claude: the .claude.json file and Claude desktop cookies
  • ChatGPT: cookies
  • OpenAI Codex: config.toml and .env files
  • Tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro
  • AWS credentials

Symantec states that "earlier versions of the malware did not target AI-related files". So the count went from 0 named AI products to 8, which Symantec reads as a recent and expanding capability. The report does not attribute Aoki to a known group, and it does not say how Aoki is delivered. Infosecurity Magazine's write-up adds Symantec's view: stolen AI keys can be resold, or used to run up the victim's bill.

Why the consensus reading is incomplete

Aoki's target list is often read as a story about chatbot accounts. The usable reading is different: the session is the small prize, and the bigger prize is what the agent can reach.

An MCP config lists the servers an agent talks to, and it can also hold their keys. A GitHub token, a database URL or a cloud key pasted inline is a map of your estate. Gen Digital makes the same point; its report says MCP configs may contain endpoints, headers, environment variables and API keys.

So the headline figure is 8 AI products. The usable figure is the number of services those 8 products can touch on your machines. Nobody outside your organisation knows that number, but you can count it this week.

Data sliced by stealer family

Stealer families beyond Aoki are documented too. Gen Digital's Jan Rubín covered 4 more on 8 September 2026, in Infostealers Have Found a New Target: Your AI Agent. Over 3 months, Gen's Windows telemetry recorded Amatera and Remus detections among tens of thousands of protected users. Gen also counted over 5,000 CallbackBeaver samples in a recent 30-day window.

The threat.cafe Stealer Target Cohort, October 2026, puts both reports side by side. It counts the AI products each vendor names per family:

threat.cafe Stealer Target Cohort, October 2026
Sources: Symantec (Aoki, 15 Oct 2026); Gen Digital (4 families, 8 Sep 2026)
n = 5 stealer families, 12 distinct AI products named

Family          | Reported by | Platform | AI products named                               | Count
----------------|-------------|----------|-------------------------------------------------|------
Aoki            | Symantec    | n/s      | Claude, ChatGPT, Codex, Copilot, Cursor,        | 8
                |             |          | Gemini, JetBrains AI Assistant, Kiro            |
Djinn Stealer   | Gen Digital | macOS    | Claude, Codex, Gemini, Cline, OpenCode, Kilo    | 6
Remus           | Gen Digital | Windows  | Claude, Cursor, OpenCode                        | 3
Amatera         | Gen Digital | Windows  | Cline, Continue                                 | 2
CallbackBeaver  | Gen Digital | n/s      | Cursor, Claude                                  | 2

Products named by the most families (of 5):
Claude 4 of 5 | Cursor 3 of 5 | Codex, Gemini, Cline, OpenCode 2 of 5 each
n/s = not stated per family in the source

The median family names 3 products, and the range runs from 2 to 8. Claude appears in 4 of 5 families and Cursor in 3 of 5. If you support only 2 tools, those 2 set your base rate.

Competing explanations and confounders

The cohort has 3 confounders, and it should be read with them in view.

First, selection bias: two vendors chose what to publish. A family that steals Kiro tokens but has not been analysed will not appear, so absence from the table is not evidence of absence.

Second, telemetry bias: Gen's counts are detections on its own users, and Gen says they are not confirmed infections and may overlap. Symantec gives no prevalence figure at all.

Third, naming drift: "Claude" in one report may mean the desktop app, and in another it may mean Claude Code's files. The cohort counts product names, not file paths.

A rival explanation exists for the trend: stealers may simply sweep more of the home directory than before, making AI files collateral rather than a target. Symantec's version comparison argues against it, because Aoki's authors added named paths for named tools. That is deliberate work.

Make the files worth less

File-level prevention is cheaper than recovery. Gen notes that MFA may not stop a stolen session token, and its advice after an infection is to revoke sessions and rotate credentials from a clean device. Six steps, in order of effort:

  1. Find inline secrets. Search ~/.claude.json, project .mcp.json files, ~/.codex/config.toml and working-directory .env files. Anthropic's MCP docs confirm Claude Code stores local and user-scope MCP servers in ~/.claude.json.
  2. Swap values for references. Claude Code expands ${VAR} in .mcp.json for env, url and headers. The file then holds a name, not a key, so inject the value from a secret manager at launch.
  3. Use the OS credential store. Codex caches logins "in a plaintext file at ~/.codex/auth.json or in your OS-specific credential store". Admins can enforce cli_auth_credentials_store = "keyring". OpenAI says to "treat ~/.codex/auth.json like a password". Claude Code uses the macOS Keychain but falls back to ~/.claude/.credentials.json on Linux, on Windows and when the Keychain is locked.
  4. Shorten token lifetimes. AWS recommends IAM Identity Center or other short-term credentials over keys kept in ~/.aws/credentials. Scope each MCP token to 1 repository or dataset.
  5. Write the rotation list now. Use the table below, one copy per client.
  6. Alert on the wrong reader. Most EDR and RMM tools can watch file reads. Alert when a process other than the agent, editor or shell reads these paths. Expect backup and sync agents in week 1.

The threat.cafe Token Location Table records only what first-party docs confirm. Rows we could not confirm say so.

threat.cafe Token Location Table, October 2026 (verify per client)
n = 9 rows; 5 confirmed from vendor docs, 4 marked "check vendor docs"

Tool         | Default store          | Plaintext / file path          | Revoke or rotate
-------------|------------------------|--------------------------------|------------------------------------
Claude Code  | macOS Keychain         | ~/.claude/.credentials.json    | /logout; rotate keys named in
             |                        | (Linux, Windows, fallback);    | ~/.claude.json or .mcp.json at the
             |                        | MCP config in ~/.claude.json   | issuing service
Codex        | auth.json or keyring   | ~/.codex/auth.json             | Log out; enforce keyring store;
             | (admin setting)        |                                | rotate any API key used
Copilot CLI  | OS keychain            | ~/.copilot/config.json         | /logout removes local token only;
             | ("copilot-cli")        | (optional fallback)            | revoke in GitHub Settings >
             |                        |                                | Applications > Authorized OAuth Apps
AWS          | n/a                    | ~/.aws/credentials             | Deactivate access keys; move to
             |                        |                                | IAM Identity Center
Claude app / | Session cookies        | n/a                            | Sign out; check vendor docs
ChatGPT      |                        |                                |
Cursor       | check vendor docs      | check vendor docs              | check vendor docs
Gemini       | "cached locally"       | check vendor docs              | check vendor docs
JetBrains AI | check vendor docs      | check vendor docs              | check vendor docs
Kiro         | check vendor docs      | check vendor docs              | check vendor docs

A keychain does not stop malware running as the user, but it raises the cost. That is the point.

The strongest case against this advice

The strongest objection to config hygiene runs like this. A stealer runs as the user, so in principle it can reach cookies, environment variables and anything else the user can open. Moving a key from a file to a secret manager just moves it. Once a laptop is infected only rotation helps, so the hours belong in rotation drills instead.

Part of that is right: rotation is the floor, and the table above exists for it. But the objection assumes the stealer gets everything. Aoki's list, as Symantec describes it, is a list of files and tokens. A reference such as ${GITHUB_TOKEN} in a stolen config is a name, not a credential. AWS says temporary credentials copied from its access portal last 12 hours at most. A token kept only in a keychain is one more step away. Each step shrinks what a file-based stealer leaves with.

Where this would be wrong

The advice above weakens under 3 conditions. If a family starts dumping process memory or environment variables at scale, references help less. If vendors move all tokens into OS stores by default, the file sweep loses value without our help. If a tool lets a stolen file refresh a short-lived token without limit, "short-lived" means little, so check that last one per tool.

What we don't know yet

Symantec's report gives no delivery route and no prevalence figure. Gen's figures are detections, not confirmed infections, and neither report says whether stolen MCP configs have been used to reach the services behind them. The target list grew between Aoki versions, so treat it as a floor. Unknown isn't the same as fine.

What to tell the people who sign off

  • Finance: the work is a few hours per client to audit configs and write the rotation list. No new licence is needed where EDR already runs.
  • Security lead: the blast radius of a stolen laptop shrinks to what its tokens can reach, for as long as they live.
  • Legal and compliance: a stolen MCP config may expose client systems. Know which client data each agent could reach before a notification decision arrives.
  • Operations: file-read alerts need about a week of tuning. Rolling back a reference is one config edit.

A note for MSPs

MSP clients usually carry the problem in 1 or 2 places, and most of what sits on their laptops is fine. Some of it is not: an MCP config with a long-lived token pasted in during a demo. Find those, move them behind references and write down how to revoke each one. If you already treat the developer laptop as a privileged workstation, this fits that baseline.

Check where an agent skill, MCP server or package came from against the threat.cafe board. The board covers how a stealer arrives, and the steps above cover what it leaves with.

Volatility: VOLATILE (event-triggered review). Review when Symantec or Gen Digital publish a new stealer target list, or when any tool in the table changes its default credential store.

Sources

#infostealers #credential-hygiene #mcp-configuration #token-rotation #endpoint-detection

All posts