Yangi zararli dastur AI kodlash vositalarini nishonga olib, kirish tokenlari, SSH kalitlari va bulut ma'lumotlarini o'g'irlashni maqsad qilgan

Yangi kuzatilgan Aokigahara nomli infostealer AI kodlash yordamchilari, dasturchi ish stansiyalari va bulut ma'lumotlarini nishonga olmoqda, bu esa ma'lumot o'g'irlashni brauzerlar va kriptovalyuta hamyonlaridan tashqariga kengaytirmoqda.

Nishonlar orasida Claude Code va Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI va JetBrains AI Assistant mavjud.

Bu mahsulotlarda aniqlangan zaiflikdan foydalanish o'rniga, zararli dastur mahalliy ilova saqlash joylarida potentsial qimmatli fayllarni qidiradi. Biroq, har bir nishonga olingan konfiguratsiya fayli ham foydalanish mumkin bo'lgan autentifikatsiya sirlarini o'z ichiga olmaydi.

Aokigahara'ning maxsus aisessions ishlovchisi Codex autentifikatsiya va konfiguratsiya fayllarini, Claude ma'lumotlarini, Cursor va Windsurf holat ma'lumotlar bazalarini hamda GitHub Copilot saqlash joyini yig'adi.

Yig'ish doirasi Amazon Q, Kiro, AWS ma'lumotlari va AWS yagona kirish (single sign-on) keshlarini ham qamrab oladi. Bu tartib qo'shimcha ravishda Windows Credential Manager'ni so'raydi, bu esa oddiy fayllardan tashqari yig'ishni kengaytiradi.

Foydalanish mumkin bo'lgan tokenlar hujumchilarga buzilgan AI hisoblariga kirish, pullik xizmatlardan foydalanish yoki shaxsiy suhbatlar va dasturlash ma'lumotlarini ochib qo'yish imkonini berishi mumkin. Kirishni qayta sotish ham potentsial monetizatsiya yo'li hisoblanadi.

Biroq, Check Point tahlili operatorlar o'g'irlangan materialni qanday monetizatsiya qilishini aniqlamaydi va har bir yig'ilgan sessiyaning haqiqatan ham yaroqli ekanligini tasdiqlamaydi.

Symantec Threat Hunter Team'ning tegishli tadqiqoti zararli dasturni Aoki, shuningdek Aokigahara nomi bilan kuzatadi.

Uning natijalari AI ma'lumotlarini yig'ish yangi versiyalarda paydo bo'lganini ko'rsatadi, bu esa so'nggi tahlilni butunlay alohida zararli dastur oilasidan ko'ra, rivojlanib borayotgan o'g'irlash qobiliyati bilan bog'laydi.

Check Point Research zararli dasturni yovvoyi muhitda hujjatlashtirgan va keng tarqalgan AI ilovalaridan autentifikatsiya fayllari, sessiya ma'lumotlari va konfiguratsiya fayllarini yig'adigan maxsus tartiblarni aniqlagan. Avvalgi versiyalar Kamidere yoki Stygian nomlari bilan tarqalgan bo'lishi mumkin.

Nishonga Olingan AI Kodlash Vositalari

Alohida ide ishlovchisi kod muharrirlari va dasturlash muhitlarini, jumladan Visual Studio Code, Cursor, Windsurf va JetBrains mahsulotlarini qidiradi.

Nishonlar orasida Git ma'lumot fayllari, .ssh ostidagi shaxsiy kalitlarni o'z ichiga olishi mumkin bo'lgan fayllar hamda AWS, Azure va Google Cloud ma'lumot va konfiguratsiya fayllari mavjud. Mos keladigan mazmun zararli dasturning yuklash tartibiga o'tkaziladi.

Bu individual AI obunalari doirasidan tashqari potentsial ta'sirni yaratadi. Haqiqiy o'g'irlangan sirlar repozitoriylar, bulut resurslari va bog'langan dasturlash xizmatlariga kirish imkonini berishi mumkin.

Amaliy ta'sir ma'lumotlarning yaroqliligi, ruxsatlar va yig'ilgan fayllar haqiqatan ham tiklanadigan sirlarni o'z ichiga olishi yoki olmasligiga bog'liq.

An'anaviy qobiliyatlar keng qamrovli bo'lib qoladi: brauzer parol va cookie o'g'irlashi, skrinshotlar, bufer yig'ish, kriptovalyuta hamyonlarini yig'ish va xabar almashish, elektron pochta, VPN, FTP va parol boshqaruv ilovalaridan o'g'irlash.

Alohida tushirilgan komponent bufer manipulyatsiyasini boshqaradi; uning nishonga olingan hamyon formatlari tasdiqlanmagan.

Zararli dastur shifrlangan konfiguratsiyasini .stgcfg bo'limida saqlaydi va uni AES-256-CBC yordamida shifrdan ochadi.

Konfiguratsiya maydonlari buyruq va nazorat infratuzilmasini, server X25519 ochiq kalitini, modul tanlashni, sertifikat pinlash sozlamalarini va zaxira URL'larni belgilaydi. O'chirilgan modullar bajariladigan faylda joylashgan holda qoladi.

Ma'lumot chiqarish /gate/handshake, /gate/chunk va /gate/complete yo'llari orqali amalga oshiriladi. X25519 almashinuvi umumiy kalit materialini o'rnatadi, SHA-256 esa yig'ilgan ZIP arxivlarini AES-256-GCM bilan shifrlash uchun ishlatiladigan kalitni hosil qiladi.

Yuklash sarlavhalari yig'ish modullarini va chunk ketma-ket raqamlarini aniqlaydi.

Yakuniy xabar yuklash bosqichining tugashini belgilaydi, bu esa har bir uzatish muvaffaqiyatli yakunlanganini mustaqil tasdiqlash emas.

Ixtiyoriy tahlilga qarshi tekshiruvlar debugger ko'rsatkichlari, virtualizatsiya artefaktlari, apparat resurslari, jarayonlar soni, kursor harakati va shubhali hisob nomlarini tekshiradi.

Sozlanadigan til tekshiruvlari ham bajarilishni to'xtatishi mumkin. Birgalikda, bu nazoratlar avtomatlashtirilgan tahlilni murakkablashtiradi, shu bilan birga operatorlarga individual tuzilmalar uchun yig'ish qobiliyatlarini tanlash imkonini beradi.

So'nggi namunalar Microsoft-CryptoAPI/10.0 User-Agent yordamida aloqa qiladi, bu esa tahlil qilingan versiyalar va konfiguratsiya o'zgarishlari bo'yicha davom etayotgan rivojlanishni aks ettiradi.

IOC'lar

Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola qilishning oldini olish maqsadida ataylab defang qilingan (masalan, [.]). Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedkasi platformalarida qayta fang qiling.

A newly observed infostealer called Aokigahara is targeting AI coding assistants, developer workstations, and cloud credentials, expanding credential theft beyond browsers and cryptocurrency wallets.

The targets include Claude Code and Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and JetBrains AI Assistant.

Rather than exploiting an identified vulnerability in these products, the malware searches local application storage for potentially valuable files. However, not every targeted configuration file necessarily contains usable authentication secrets.

Aokigahara’s dedicated aisessions handler collects Codex authentication and configuration files, Claude credentials, Cursor and Windsurf state databases, andGitHub Copilot storage.

Its collection scope also covers Amazon Q, Kiro, AWS credentials, and AWS single sign-on caches. The routine additionally queries Windows Credential Manager, extending collection beyond ordinary files.

Usable tokens could let attackers access compromised AI accounts, consume paid services, or expose private conversations and development information. Reselling access represents another potential monetization route.

Check Point’s analysis, however, does not establish how the operators actually monetize stolen material or confirm that every collected session remains valid.

Related research from Symantec’s Threat Hunter Team tracks the malware as Aoki, also known as Aokigahara.

Its findings indicate that AI credential collection appeared in newer versions, connecting the latest analysis to an evolving theft capability rather than an entirely separate malware family.

Check Point Research documented the malware, in the wild and identified dedicated routines that collect authentication files, session data, and configuration files from widely used AI applications. Earlier versions may have circulated as Kamidere or Stygian.

AI Coding Tools Targeted

A separate ide handler searches code editors and development environments, including Visual Studio Code, Cursor, Windsurf, and JetBrains products.

Targets include Git credential files, files under .ssh that may contain private keys, and AWS, Azure, and Google Cloud credential and configuration files. Matching contents pass to the malware’s upload routine.

This creates potential exposure beyond individual AI subscriptions. Valid stolen secrets could provide access to repositories, cloud resources, and connected development services.

The practical impact depends on credential validity, permissions, and whether collected files actually contain recoverable secrets.

Traditional capabilities remain extensive: browser password and cookie theft, screenshots, clipboard collection, cryptocurrency wallet harvesting, and theft from messaging, email, VPN, FTP, and password-management applications.

A separate dropped component handles clipboard manipulation; its targeted wallet formats remain unconfirmed.

The malware stores its encrypted configuration in the .stgcfg section and decrypts it using AES-256-CBC.

Configuration fields define command-and-control infrastructure, a server X25519 public key, module selection, certificate-pinning settings, and fallback URLs. Disabled modules remain embedded in the executable.

Exfiltration uses /gate/handshake, /gate/chunk, and /gate/complete. An X25519 exchange establishes shared key material, while SHA-256 derives the key used to encrypt collected ZIP archives with AES-256-GCM.

Upload headers identify collection modules and chunk sequence numbers.

The completion message marks the upload phase’s end, not independent confirmation that every transfer succeeded.

Optional anti-analysis checks inspect debugger indicators, virtualization artifacts, hardware resources, process counts, cursor movement, and suspicious account names.

Configurable language checks can also terminate execution. Together, these controls complicate automated analysis while allowing operators to select collection capabilities for individual builds.

Recent samples communicate using the Microsoft-CryptoAPI/10.0 User-Agent, reflecting continued development across analyzed versions and configuration changes.

IOCs

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.