The Target Shifts from "the Browser" to ".claude.json": Aoki Adds Coding-Agent Credential Files to Its Hit List

Credential-harvesting malware (infostealers) has started going after not just browser passwords and credit card numbers, but also the configuration files that your local coding agents keep on disk. On October 15, 2026, Symantec's Threat Hunter Team reported that the latest samples of a stealer known as "Aoki" (aka Aokigahara) have added the credentials of AI coding assistants to their targets. Aoki itself has been observed since early 2026, but the team notes that the capability to steal AI-related files is a recent addition.

"AI Config Files" Join the Hit List

According to the report, Aoki's new reach extends to the authentication- and session-related files that developers routinely leave sitting locally without a second thought. Specifically, the following are called out.

Aoki was originally a "general-purpose" stealer that pulled cookies, autofill data, credit card details, and history from dozens of browsers, and went on to collect crypto wallets, password managers, and even VPN configurations. What changed this time is that the credentials of AI coding tools have been explicitly folded into that collection scope. The stolen data is said to be sent to a C&C (command-and-control) server via an endpoint called /gate. Notably, how Aoki makes its way onto a machine in the first place (its distribution method) was not identified in this report.

How Far Can the Damage Reach When a Single Key Leaks?

The weight of leaking a single API key or session token is qualitatively a bit different from a traditional password breach. These tokens are "the key that drives the AI on your behalf." The report explains that a stolen token lets an attacker act as the legitimate user, burning through that account's usage allowance (the billable usage) and reaching the services tied to the account.

Coding-agent credentials in particular don't exist in isolation. Agents are designed to operate hooked up to repositories, the cloud, and CI/CD pipelines. As a result, if a .claude.json or Codex's config.toml/.env leaks, the report warns that it can serve as a foothold for the damage to spread to source code, connected clouds, and build infrastructure. The picture here is that, in exchange for convenience, a seemingly mundane local config file has become an "entry point to your assets."

What to Do Right Now

The countermeasures reported by outlets such as SC Media boil down to basic moves that require no special tooling. If you suspect an infection, the following are recommended, performed from a separate, clean machine.

• Expire your active AI sessions (log out / revoke)
• Rotate (reissue) any exposed API keys and related credentials
• Review your account activity (check for usage you don't recognize)

As ongoing preparation, the advice is to monitor for unexpected access to AI tool folders and for unfamiliar outbound traffic, and not to leave long-lived secrets sitting in files that local apps can read. Keeping tokens short-lived and not reusing them, and moving toward environment variables or secret-management systems, make for practical defenses.

With the spread of coding agents, developers now have more "unlocked drawers" lying around. This report, showing that attackers have set their sights on them, is best taken as a warning that the convenience comes with a need to rethink how local credentials are managed. For now the guidance centers on detection products from specific vendors being able to block it, and there is no silver-bullet countermeasure. As a start, it's worth taking a moment to check what's actually inside your own .claude.json and config.toml.

References: Symantec (security.com): Aoki Infostealer Now Targeting AI / Cybersecurity News: New Aoki Malware Targets ChatGPT, Claude, Codex and Gemini / SC Media: New infostealer targets AI coding assistant credentials / Security Online: Aoki Infostealer Harvests API Keys and Tokens