"Like card data, a stolen AI key can be cashed in directly, either through resale or by running up usage on the victim's account, a practice sometimes called LLMjacking. Unlike card data, it can also give an attacker a route into the developer's wider environment," Symantec researchers warned.
Symantec's October 15 finding: Aoki has evolved
On October 15, Symantec published a report from its Threat Hunter Team documenting a notable shift in the Aoki infostealer's behavior. First observed earlier in 2026 and described by Symantec as "relatively new and sparsely documented," Aoki originally focused on browser data, cryptocurrency wallets and password managers. The team says the latest versions now target files and tokens associated with AI coding assistants — a capability absent from earlier samples.
Aoki's new targets: files, tokens and named AI assistants
According to Symantec, the newest Aoki variant harvests API keys, session files and cookies tied to multiple AI coding assistants. The report lists specific file names and artifacts the stealer takes: .claude.json, Claude desktop cookies, ChatGPT cookies, and Codex config.toml and .env files. Symantec further reports that Aoki has stolen tokens for GitHub Copilot, Cursor, Gemini, JetBrains AI Assistant and Kiro, and also exfiltrated Amazon Web Services (AWS) credentials.
Symantec explicitly names the AI coding assistants whose credentials Aoki can access: Anthropic’s Claude, OpenAI's Codex, SpaceX’s Cursor and Google’s Gemini. The researchers describe this expansion as recent and apparently still growing.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow stolen AI credentials are useful to attackers
Symantec frames stolen AI keys as fungible, monetizable commodities. The researchers note two direct abuses: resale of keys on illicit markets, and "running up usage on the victim's account" — an abuse sometimes called LLMjacking. Beyond immediate monetization, Symantec points out that keys and tokens can provide an attacker with access to connected repositories, cloud services and CI/CD pipelines tied to the developer's account, potentially enabling lateral movement or further compromise.
Symantec also characterizes Aoki as "a highly capable and multi-functional infostealer whose capabilities still appear to be in active development," underlining that the toolset is changing and expanding in scope.
Attack profile: financially motivated actors and a broad target set
While Symantec warns about the new AI-focused capabilities, it also stresses it does not know which specific threat group is behind Aoki. The company reports there are no indications linking Aoki to any existing malware family. At the same time, Symantec highlights the remainder of Aoki's target list — with a continued emphasis on cryptocurrency wallets and related browser extensions — as evidence that the actors are financially motivated.
What this means for developers, cloud teams, and security operators
- Developers: Tokens, config files and session cookies for AI coding assistants are now explicit targets. Developers who store API keys or keep persistent session artifacts locally face the risk that a stolen key could be used under their identity and throttle or exhaust their account usage quotas.
- Cloud teams and CI/CD operators: Symantec notes that stolen AI tokens can expose connected repositories, cloud services and CI/CD pipelines. Teams responsible for build and deployment pipelines should be aware that credential theft can be a vector to systems beyond the AI service itself.
- Security operators and incident responders: The Symantec team describes Aoki as under active development and capable of exfiltrating both AI-related and traditional high-value targets such as crypto wallets. That combination suggests investigations should treat AI credentials with the same priority as other high-value secrets.
Symantec's findings draw a clear line between what the researchers see as two realities: AI-related credentials now hold direct resale or abuse value, and they can serve as stepping stones into broader developer environments. The company also leaves a central question open — who is developing and operating Aoki — noting that the origin and affiliations of the operators remain unknown while the malware's feature set continues to expand.
