Threat
Infostealer riding the AI Train - Check Point Research
First reported checkpoint.com
Page published
Earliest dated coverage: 27 Oct 2026 · First observed: 27 Oct 2026 · Latest dated coverage: 27 Oct 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
Aokigahara's targeting of AI authentication material and developer credentials could turn a compromised endpoint into unauthorized access to AI services and cloud infrastructure.
Aokigahara is an infostealer observed in the wild that targets Windows systems and collects authentication files, session data, and configurations from AI applications including Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI. Check Point researchers also identified collection of Git credentials, SSH private keys, and AWS, Azure, and Google Cloud credential and configuration files.