Summary
- Symantec identifies Aoki variants collecting credential and session files for Claude, Codex, Cursor, Gemini and other coding tools.
- The malware also targets conventional browser, cloud and wallet secrets; the operator and the distribution of European infections are unknown.
- Black Duck experts separately discuss possible repository and CI/CD consequences, not outcomes confirmed by Symantec.
Researchers at Symantec have found recent variants of the Aoki infostealer collecting authentication files associated with AI coding assistants. The findings establish an expanded collection capability, not a verified compromise of the repositories or cloud services that developers may connect to those tools.
Researchers in Symantec’s Threat Hunter team say recent Aoki samples target credential and session files associated with Anthropic’s Claude, OpenAI’s Codex, Cursor, Codeium, Gemini, and other coding tools. Earlier samples examined by the team did not include these files, indicating that the malware’s capabilities have expanded during 2026.
The most recent variant also gathers conventional secrets from web browsers, cryptocurrency wallets, password managers, communications applications, VPN and FTP clients, and cloud tooling. Symantec says it seeks Amazon Web Services credentials, GitHub Copilot tokens, and configuration files used by development assistants. The malware collects available data and transmits it to attacker-controlled infrastructure rather than relying on a separate backdoor command list.
AI coding assistants often run locally or through development environment integrations that retain authentication tokens. Those credentials make repeated access to the service possible without entering a password for every request. Their precise permissions vary by provider and deployment: some authorise model usage alone, while others may be associated with repository access or tooling that can execute actions on a developer’s behalf.
As a result, stealing an AI assistant token should not automatically be equated with control of a source code repository. However, an infected development workstation may hold several related credentials. A thief who obtains a cloud token, repository session, and AI assistant configuration from the same machine can potentially combine them to reach systems beyond the original endpoint.
Commenting separately on the research in material supplied to Cyber Insider, Boris Cipot, principal security engineer at Black Duck, linked the new targets to changing software development workflows. He said: “A few years ago, criminals mainly wanted passwords, browser sessions, or crypto wallets. Now AI coding tools are on that target list because they are increasingly tied to source code and development workflows.”
The business consequences depend on what was available to the infostealer and whether attackers successfully use it. Possible effects include unauthorised AI service charges, disclosure of proprietary source code, changes to repositories, or access to connected automation. Symantec’s published investigation does not establish that all those events occurred in the particular infections it analysed.
In the same separately supplied commentary, Vineeta Sangaraju, AI research engineer at Black Duck, urged organisations to manage AI tool tokens with protections comparable to other infrastructure credentials, including limits on permissions and lifespan. These are the experts’ recommendations and projections of potential effects, not independent evidence that this Aoki campaign has altered repositories, penetrated CI/CD pipelines, or compromised European organisations.
One operational difficulty is that development tools spread credentials across several configuration locations, some of which fall outside traditional enterprise password vaults. Workstations used for development may also connect to personal or experimental AI subscriptions, creating uncertainty over which identities can reach business systems. An accurate response to a confirmed infostealer incident has to establish which authentication artefacts were present and what those artefacts authorised.
The report also brings different kinds of credentials into one incident category. An API key may permit use of a cloud model with associated charging, whereas a session token may allow access to an application account. A repository token can have read-only or write permissions, while an AWS credential may carry specific cloud privileges. Their coexistence on one endpoint creates aggregation risk, but these permissions cannot be inferred from a file name alone. Security reviews of developer computers therefore need to match a stolen artefact to the rights it carried at the time of theft. The question of whether those rights were later misused requires separate evidence from provider logs or repository activity.
Symantec published technical indicators for Aoki and says its endpoint products detect the family. It did not attribute the operator, quantify the number of affected European organisations, or document a specific downstream repository or cloud-service compromise resulting from the newly targeted tokens. Black Duck’s supplied analysis explains plausible risks arising from such credentials, but does not resolve those evidential gaps.
