Aoki infostealer steals AI coding keys: rotate and cap

The API key in your developer's .env file is now on a malware shopping list. On October 15, Symantec's Threat Hunter Team published research on Aoki, an infostealer whose recent versions hunt AI coding assistant credentials: Claude, Codex, Cursor, GitHub Copilot and more. Older samples did not do this. The attackers added it because AI keys now pay.

What actually happened

Per Symantec's report and Infosecurity Magazine's coverage:

• The target list. Claude's .claude.json file and desktop cookies. ChatGPT cookies. OpenAI Codex config.toml and .env files. Cursor tokens and its local state database, which can cache chat context and code snippets. Tokens for GitHub Copilot, Gemini, JetBrains AI Assistant and Kiro. AWS credentials.
• The rest of the haul. Browser cookies and saved cards, crypto wallets, password manager data, Discord and Telegram tokens, VPN and FTP logins. It also records which security products the machine runs.
• The method. No command menu. It grabs what it finds and sends it to a command-and-control server.
• The unknowns. Symantec does not know who runs Aoki or how it reaches victims, and found no link to a known malware family.

Symantec's point: a stolen AI key lets an attacker act as the developer and spend the developer's quota, and the token can open the repos and cloud pipelines it connects to.

Why it matters for your business

We wrote about stolen Claude sessions in August. Aoki is the wider version. It is not one vendor's cookie. It is every AI tool on a developer laptop, plus the plaintext config files those tools read.

For a small team, the damage comes in two shapes. One is a surprise bill when someone runs a model on your key. The other is worse: a token with repo or cloud access is a key to your codebase.

What we do on our own machines and client builds:

• Kill plaintext long-lived keys. Pull secrets from a vault or the OS keychain at runtime. A .env with a production key is a gift.
• One key per person, per project. When a laptop is hit, you revoke one key, not the whole company's.
• Set hard spend caps. Every provider console has usage limits. Set them low and get the alert.
• Scope the tokens. A coding assistant needs read access to one repo, not admin on the org.
• Rotate on any suspicion. Malware alert, lost laptop, odd usage graph: rotate first, investigate second.

Sources: Symantec Threat Hunter Team, Infosecurity Magazine.