The Target Shifts from "the Browser" to ".claude.json": Aoki Adds Coding-Agent Credential Files to Its Hit List
The infostealer "Aoki," reported by Symantec, has started stealing not just browser data but the credential files of coding agents—like .claude.json and Codex's config.toml and .env. If a key leaks, an attacker can act as you to consume your usage allowance and reach connected clouds. It's time to r