DEV Community

Anoymask
Anoymask

Posted on

Aokigahara: Windows Infostealer Targeting Codex, ChatGPT, Claude, and Cloud Credentials

#security #threatintel

1. Overview

2. Executive Summary

Aokigahara is a Windows infostealer that targets credentials for web browsers, cryptocurrency wallets, and VPN clients, as well as configuration and session files for AI development assistant tools such as Codex (auth.json), Claude, ChatGPT Desktop, Cursor, Windsurf, GitHub Copilot, and Gemini CLI. It also targets cloud credentials for AWS, Azure, and Google Cloud, along with SSH private keys. Collected data is organized into ZIP archives by functional module, encrypted with AES-256-GCM using a shared key derived from an X25519 key exchange, and transmitted in chunks to the /gate/chunk endpoint.

By targeting credentials for AI development tools, cloud services, and repositories, it creates a risk that one infected developer endpoint could lead to a broader compromise of source code repositories and cloud infrastructure. While this malware has been observed in the wild, public reports do not confirm the overall scale of abuse using the stolen credentials.

3. Attack Flow

Credential Collection and Encrypted Exfiltration

  1. Aokigahara begins execution on a Windows endpoint, sequentially activating collection features enabled by the embedded module_mask configuration to scan target file paths for web browsers, AI development assistant tools, development environments, and cloud settings. Note that not all scanned files contain valid credentials.
  2. Data for each collection module is compressed into a ZIP archive and encrypted with AES-256-GCM using a key derived from an X25519 shared secret.
  3. After connecting to the C2 server at /gate/handshake and receiving an HTTP 200 response, it sends the encrypted archive in chunks to /gate/chunk, and finally notifies the server of transmission completion via /gate/complete. Note that the presence of a completion notice does not confirm that all data successfully reached the C2 server.

The following table summarizes the attack flow and investigation considerations based on malware analysis and public information. It does not establish that every module ran or succeeded in every sample or on every infected endpoint.

Inference: The defender indicators are investigation leads that depend on available logs and retention. They do not establish the initial access vector, where ZIP archives were stored, or whether stolen information was successfully used in a subsequent compromise.

Attack Stage Attacker Action / Technique Tools / Communications Defender Indicators (Prerequisites & Artifacts)
Endpoint Intrusion and Execution The malware starts execution on the victim's Windows endpoint under user privileges. Aokigahara executable (distribution and initial access vector unconfirmed) Startup of unknown processes, alerts from Application Control or EDR, execution from suspicious parent processes
Comprehensive Credential Scanning Based on the configured module mask, it scans target paths including AI tools (Codex, Claude, Copilot, etc.), cloud settings (AWS/Azure/GCP), SSH keys, and browser data. Built-in handlers such as aisessions and ide, Windows Credential Manager High-volume file access events to specific paths such as .codex/auth.json, .aws/credentials, and .ssh/id_* in a short timeframe
Archive Creation and Encryption Packages collected data into a ZIP archive for each module and encrypts it with AES-256-GCM using a key derived from an X25519 shared secret. Built-in ZIP compression routine, AES-256-GCM encryption Correlating the compression, encryption, and transmission of collected data. Public disclosures do not confirm ZIP disk storage locations or temporary file deletion
C2 Handshake and Transmission Performs a handshake with the C2 server, splits the encrypted archive into chunks, and sends via HTTP POST. HTTP POST, /gate/handshake, /gate/chunk, /gate/complete User-Agent Microsoft-CryptoAPI/10.0 used in recent analysis samples (varies by version), custom header X-Chunk, HTTPS traffic directed to C2
Completion Notice and Subsequent Risk Notifies completion via /gate/complete and performs local session cleanup after receiving HTTP 200. Self-deletion of the executable and successful downstream compromise using stolen tokens have not been confirmed. Completion notice, session cleanup Completion notice alone does not indicate successful upload of all data. Inference: Token usage from different IPs, cloud API operations, and repository clones are candidates for separate investigation

4. Attacker Position and Execution Location

  • The attacker must be able to run the malware on a victim's Windows endpoint. Public reports do not identify the initial access vector.

5. Visibility for Victims and Administrators

  • Victims: Because no prominent GUI screens or warnings appear during execution, endpoint users will have difficulty noticing immediately; they may only realize it after receiving unauthorized external account login notifications or noticing unauthorized cryptocurrency wallet transfers.
  • Administrators: Can observe concentrated file access to numerous AI and cloud setting paths in a short period, ZIP archive generation processes, POST transmission of encrypted data, and sudden process terminations associated with anti-analysis measures.

6. Success and Failure Conditions

Success Conditions

  • The malware executes under the user context on a Windows endpoint.
  • Target files or browser sessions—such as AI tools, cloud settings, and SSH keys—exist locally and are readable by the execution privileges.
  • Outbound HTTP/HTTPS communication from the endpoint to the C2 server is not blocked.

Failure Conditions and Countermeasures

  • Block unauthorized and unknown binary executions using Application Control or EDR execution blocking policies.
  • Use short-lived credentials for AI services, cloud platforms, and Git wherever possible, and apply least privilege.
  • If an infection is identified, immediately isolate the endpoint from the network, revoke active sessions for all related accounts, and rotate credentials simultaneously.

7. What Happens Upon Success

  • Theft of API tokens and session information for AI development assistance services (Codex, ChatGPT, Claude, etc.).
  • Exfiltration of Git, SSH private key, and cloud infrastructure (AWS/Azure/GCP) credentials.
  • Theft of data from web browsers, cryptocurrency wallets, password managers, and email applications.

8. Observable Logs

Inference: The following are investigation candidates based on behaviors and identifiers in public disclosures. These have not been verified via live testing for log generation or available fields. They depend on configuration and log retention status, and a single match alone does not determine successful compromise.

  • Email: No unique email-origin information has been confirmed.
  • Proxy / SWG / DNS: Check for POST requests to /gate/handshake, /gate/chunk, and /gate/complete, or connections to suspicious external IPs.
  • Endpoint / EDR: Correlate rapid bulk access to .codex/auth.json, .claude/credentials.json, .ssh, and cloud configuration files, along with ZIP creation, encryption, and transmission processes. It should not be assumed that temporary ZIP files on disk and their deletion always occur.
  • Identity / IdP: Audit creation of new sessions in AI services, GitHub, and cloud IdPs, or token usage from unusual source IPs.
  • SaaS / Cloud: Track mass repository clones, access to KMS/secrets, and suspicious cloud API calls using stolen credentials.
  • Network: Correlate the presence of the X-Chunk header and suspicious POST traffic accompanied by the User-Agent Microsoft-CryptoAPI/10.0.

9. Determining Attack Success

Confirmed by Public Information

Check Point has analyzed the malware code and communication methods observed in the wild. This does not indicate that all modules executed across all samples, or that all types of secrets were stolen on individual victim endpoints.

Internal Assessment Criteria

  • Confirming Information Theft or Session Compromise: Access to target files alone is insufficient. Verify that the malware actually read secrets it was not authorized to collect, or identify collected archives containing those secrets. This does not require an OS privilege boundary to have been crossed: malware can steal secrets that are readable with the compromised user's permissions. Do not determine credential theft based solely on configuration file name matches.
  • Corroborating Exfiltration: Correlate the contents of collected archives with transmission to /gate/chunk within the same session. Encrypted communication or /gate/complete alone does not reveal the transmitted content or successful upload of all data.

10. Investigation Playbook

  1. Trigger: A reported sample hash, bulk access to credential files, or a C2 communication pattern
  2. Initial Verification: Check host, user, sample hash, and targeted credentials
  3. Endpoint Investigation: Preserve memory, process tree, file access, and archives
  4. Identity and Cloud: Check and revoke AI, Git, and cloud sessions
  5. Subsequent Actions: Track unauthorized use of repositories, cloud services, wallets, and email
  6. Containment: Isolate the host, rotate affected credentials, and reimage the endpoint
  7. Classification: Distinguish between execution, collection, exfiltration, credential usage, and subsequent compromise

11. Defense and Detection Ideas

  • Single Event: Access to multiple AI credential paths by an unapproved process
  • Time-Series Correlation: Credential access → ZIP → /gate/chunk → new cloud session
  • Hunting: Inventory secrets, including those used by AI tools
  • Log Gaps: Encrypted traffic alone does not reveal the exfiltrated content
  • Priority Action: Prioritize EDR containment and credential rotation

12. Facts, Inference, and Hypothesis

Facts

  • Aokigahara has been observed in the wild, collecting browser credentials, wallets, VPNs, password managers, and email data.
  • The aisessions handler targets Codex (.codex/auth.json), Claude credentials, ChatGPT Desktop storage, Cursor, Windsurf, Copilot, and Gemini CLI.
  • The ide handler collects Git credentials, .ssh files, and AWS/Azure/GCP settings.
  • Collection features are selected via module_mask. Not all target files contain authentication secrets, and the Windows Credential Manager is also targeted.
  • Data from each module is zipped, encrypted with AES-256-GCM using a key derived from an X25519 shared secret, and sent to /gate/chunk.
  • Research has not confirmed how operators monetized the stolen data.

Inference

  • The simultaneous theft of AI account tokens and developer credentials enables cascading compromises across conversations, source repositories, and cloud resources.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under "Unresolved Questions and Further Investigation".

13. MITRE ATT&CK Mapping

There are no practical mappings with verifiable evidence.

14. Unresolved Questions and Further Investigation

  • Initial access and distribution vectors.
  • Scope of infection and operators.
  • Extent to which stolen credentials were actually abused.

15. Impact on SOCs and Organizations

Organizations deploying AI coding tools should treat local token files as high-value secrets, and in the event of an infostealer infection, simultaneously rotate all credentials for AI, Git, cloud, and SSH.

16. Summary by Target Audience

  • For SOCs: Correlate anomalous access to AI tool credential files on developer endpoints with subsequent external POST traffic and unusual logins at cloud IdPs.
  • For Administrators: Strengthen application execution control on development endpoints, shorten the lifespan of AI, cloud, and Git tokens where possible, and apply the principle of least privilege. Because the Windows Credential Manager is also targeted, simply storing credentials in the OS credential store does not guarantee protection against malware running with the same user privileges. Upon infection, revoke related sessions and update secrets.
  • For Users: Avoid downloading or executing suspicious files, and promptly report to the security department if security software warnings appear.

Top comments (0)