An infostealer that Check Point Research calls Aokigahara has a module dedicated to AI tools. Called aisessions, it hunts for the local authentication and settings files of Claude Code, Claude Desktop, Codex, ChatGPT Desktop and Cursor on Windows. Nobody's vendor was breached: the malware needs to already be running on your machine. If it is, your AI sessions and API keys should be treated as stolen, revoked and rotated from a clean device.
This post summarises Check Point's write-up, "Infostealer Riding the AI Train" (published October 23, 2026), plus Cyber Security News' summary, and turns it into a checklist for people who run coding agents.
TL;DR
| Question | Answer |
|---|---|
| Am I affected? | Only if a Windows machine you use was infected with this stealer. Check Point does not describe how it is delivered. |
| Were AI vendors breached? | No. The malware reads files stored locally on a compromised endpoint. |
| Is there a patch? | No. This is malware, not a product bug. Detection and credential rotation are the fix. |
| Does data leave my machine? | Yes, if infected: the stealer packages files into encrypted ZIP archives and uploads them to its command-and-control server. |
| What do I rotate? | AI tool sessions and API keys, Git and SSH credentials, and AWS, Azure and Google Cloud configuration. |
| Can Beam block it? | No. It can limit and log what your agents do, but it is not endpoint protection. |
What is Aokigahara?
Aokigahara is a stealer for Windows that searches an infected machine for authentication files and application storage. Check Point says it may be an evolution of earlier malware known as Kamidere or Stygian, and that the operators' way of making money from stolen data is unconfirmed.
The AI focus is one module among several. The report describes two that matter to developers:
aisessions: data tied to Claude Code, Claude Desktop, Codex, ChatGPT Desktop and Cursor. According to the coverage, it also reaches Windsurf, GitHub Copilot, Gemini CLI, JetBrains AI Assistant, Amazon Q and Kiro, and queries Windows Credential Manager.ide: Git credentials, SSH files (which may include private keys), and AWS, Azure and Google Cloud configuration.
Beyond that it is a conventional stealer: browser credentials and cookies, screenshots, clipboard contents, and wallet, messaging, VPN and email application data.
Which files does it go after?
Check Point lists targeted paths, where %s is a base directory the report leaves undefined:
| Tool | Paths named in the report |
|---|---|
| Claude Code / Claude Desktop | %s\.claude\credentials.json, %s\.claude.json, %s\Claude, and the packaged-app LocalCache\Roaming\Claude folder |
| Codex | %s\.codex\auth.json, %s\.codex\config.toml, %s\.codex\.env |
| ChatGPT Desktop | the packaged-app LocalCache\Roaming\ChatGPT folder |
| Cursor | %s\Cursor\User\globalStorage\state.vscdb and storage.json, plus the Cursor - Insiders equivalents |
Check Point notes that not every targeted file necessarily contains an authentication secret; some may hold settings or session data only. But the ones that do are what matters: a working session token can open an account without the password, and an API key in .env or config.toml works from anywhere.
These are ordinary files because coding agents have to remember who you are between runs. That is convenient and, for malware running as your user, readable.
How the malware works, step by step
According to the report and its coverage:
- Optional evasion. It can check for debuggers, virtual machines, hardware resources, process counts and mouse movement, and can exit when the keyboard or Windows language matches an excluded group, including Russian and Ukrainian.
- Encrypted configuration. Its config is AES-256-CBC encrypted and decides which modules run. Disabled modules stay inside the executable, so a given sample may be capable of more than one run shows.
- Collection. Modules such as
aisessionsandidegather files into categories. - Packaging. Data is put into ZIP archives and encrypted with AES-256-GCM, with an X25519 key exchange used to establish the key.
- Upload. A handshake, chunked transfers per category and a completion message to the gate endpoints
/gate/handshake,/gate/chunkand/gate/complete. The completion message does not confirm that every archive arrived. - Clipper. A clipper component is dropped under
C:\Microsoft\Vault.
The report does not describe how the stealer reaches a machine, and it gives no victim counts or campaign timeline. We are not filling that gap. Earlier Beam coverage of how developers get infected in practice includes fake Claude Code installers promoted through ads and a compromised LiteLLM release that harvested AI credentials. Those are separate incidents, and nothing in the Check Point report links them to Aokigahara.
Indicators of compromise
Check Point publishes full indicators, including about 150 sample hashes; use the original report for the complete list. The ones highlighted in coverage (defanged as published):
- Command-and-control IP and port:
2[.]26[.]252[.]48:8080 - Domains:
dfwioeiofwr[.]info(withgate[.]dfwioeiofwr[.]info),dobeqnesmot[.]cc,hjazfioe[.]surf,kkeyyou[.]cc,neihite[.]cc,somelitersofblood[.]pw - Request paths:
/gate/handshake,/gate/chunk,/gate/complete - User-Agent
Microsoft-CryptoAPI/10.0in the latest samples (not conclusive on its own) - Headers such as
X-Build-ID,X-Gate-Token,X-Session,X-HWID,X-KEX,X-ChunkandX-Chunk-Index - A folder
C:\Microsoft\Vaultholding the clipper (SHA-18d6c86e0af7807f9b5baf15e9f076bb81e012515) - Strings for YARA:
AKGRES,AISessions/,aokigahara,kamidere
Block the domains and IP at your DNS or egress layer, search proxy and DNS logs for them, and treat a hit as a confirmed compromise.
What is confirmed and what is not
It helps to separate what the research establishes from what readers tend to assume.
| Claim | Status |
|---|---|
The malware contains code that targets AI tool files (the aisessions module) | Described by Check Point, with file paths and YARA strings |
| It was found in the wild | Described by Check Point; no victim counts are given |
| A vendor (Anthropic, OpenAI, Cursor) was breached | Not claimed; the data comes from infected endpoints |
| The stolen files give account access | Plausible for session tokens and API keys, but the report treats misuse and extortion as potential outcomes, not confirmed activity |
| It is an evolution of Kamidere or Stygian | Stated as "may have been known as"; the basis for the link is not explained |
| How it spreads | Not described in the report |
| Operators profit through resale or extortion | Unconfirmed |
Two practical consequences follow. First, a "no vendor breach" finding does not mean "no action": the risk sits on your side, in files your own tools write. Second, because disabled modules remain in the executable, a clean-looking run of one sample does not prove a different sample would not reach your AI folders.
How to check your own machine
You cannot see what a stealer already took, but you can see what it would find and whether anything is talking to its infrastructure.
- Inventory the files. On Windows, look in your user profile for
.claude,.codexand the CursorglobalStoragefolder. Note which hold long-lived keys rather than expiring sessions. - Search network logs. Look in DNS, proxy or firewall logs for the domains and IP above, and for requests to
/gate/handshake,/gate/chunkor/gate/complete. - Check for the dropped folder. The presence of
C:\Microsoft\Vaultis worth a closer look, since Windows does not normally use that path for this purpose. - Scan with the published YARA strings using your endpoint tool, and compare file hashes to Check Point's list.
- Review account activity. In each AI service, Git host and cloud console, look for logins, token creations or usage you do not recognise.
If any of these turn up something, move to the rotation steps below without waiting for further confirmation.
What this means if you run AI coding agents
If you have no sign of infection, reduce what a stealer would find:
- Prefer short-lived logins over long-lived keys. Where a tool lets you sign in with a session and revoke it, do that instead of pasting a permanent API key into
.envorconfig.toml. - Look at the files listed above on your own machine. If a
.codex\.envholds a key you forgot about, remove it. - Turn on MFA for AI, cloud, Git hosting and package-registry accounts, and scope cloud credentials to least privilege, so a stolen file buys less.
- Keep SSH keys passphrase-protected and out of project folders agents can read.
- Watch egress. A process that is not your agent or browser contacting an unknown host after reading these folders is the signal worth alerting on.
If you suspect an infection, follow the order the reporting recommends:
- Isolate the device from the network.
- From a clean system, revoke AI tool sessions (sign out everywhere in each account's settings) and rotate API keys.
- Rotate AWS, Azure and Google Cloud credentials, Git tokens and SSH keys, then review connected repositories and cloud accounts for activity you did not do.
- Do not stop at a password reset: stolen sessions may stay valid.
- Rebuild or fully clean the machine before signing back in.
Our first 24 hours after a vendor breach runbook covers the rotation order in more detail, and API keys in logs and env vars explains where else keys tend to sit.
Why stealers now list AI tools
Developer machines already held cloud keys, SSH keys and browser sessions. Coding agents add another class of asset: a signed-in session that can run code, spend money and reach repositories on your behalf. Stolen API keys also get resold or used for model access at your cost, a pattern we covered in AI-led attacks in October 2026. Check Point's framing, as relayed in the coverage, is that AI application credentials and session data should be treated like browser sessions, cloud credentials and developer keys. That is a sensible rule for your own threat model too.
You can follow related incidents on the October 2026 attacks timeline.
What Beam can and cannot do here
Beam is a local, on-device tool for watching and limiting what coding agents do. It does not stop this malware, because Aokigahara is a separate process on the operating system and not an agent action. Beam is not antivirus, endpoint detection or a kernel sandbox.
Where it helps is the agent side of the same risk. It flags risky agent actions such as credential exposure, can deny them through Claude Code and Codex PreToolUse hooks, and redacts known credential formats, authorization headers and private keys before anything is stored (pattern-based, so not complete). See how Beam works and what stays local. It will not tell you whether a stealer ran on your machine; use your endpoint protection for that.
Frequently asked questions
What is Aokigahara?
Aokigahara is a Windows infostealer analysed by Check Point Research on October 23, 2026. Its aisessions module searches for local authentication and settings files of AI tools including Claude Code, Codex, ChatGPT Desktop and Cursor, and packages them for upload to a command-and-control server.
Were Anthropic, OpenAI or Cursor breached?
No. Reporting on the Check Point analysis says the malware steals data stored locally on an already compromised endpoint. It does not show a breach of any vendor.
Which files does it look for?
Check Point lists paths such as .claude\credentials.json and .claude.json for Claude, .codex\auth.json, config.toml and .env for Codex, and Cursor's globalStorage state.vscdb and storage.json. Not every file necessarily holds a secret.
What should I do if I think a machine was infected?
Isolate the device, then from a clean system revoke AI tool sessions, rotate API keys, cloud credentials and SSH keys, and review connected repositories and cloud accounts. A password reset alone may leave stolen sessions valid.
Can Beam stop this malware?
No. Beam watches what supported agents do and can deny risky agent actions through Claude Code and Codex hooks, but it is not antivirus or endpoint detection and does not see a separate process on your machine reading files.
Is Windows the only target?
The analysis describes a Windows stealer, with Windows-style paths and Credential Manager queries. Credential files for these tools exist on other platforms too, but this report does not describe a macOS or Linux build.
Related reading
- Private GitHub repos deleted by non-members: claimed vs verified
- Fake Claude Code installers and InstallFix
- LiteLLM 1.107.0 compromise and AI credentials
- A backdoored Qwen model stealing Codex credentials
- Railway breach: rotate your environment variables
- Zero Breach Toolkit: vetting a free spyware scanner before you run it
- OVHcloud CLI release binaries swapped for an infostealer (v0.11.0 to v0.15.0)
- Sources: Check Point Research (primary), Cyber Security News (summary)
Details are accurate as of October 27, 2026, based on Check Point's October 23 report. Indicators and attribution may change; check the original report for updates.