Search — “aokigahara”

Check Point Research details Aokigahara (possibly earlier Kamidere/Stygian), a Windows infostealer that, beyond browser, wallet, VPN, FTP and password-manager theft, has dedicated handlers collecting auth/session files for Claude, Codex, ChatGPT Desktop, Cursor, Windsurf, Copilot, Gemini CLI, Kiro, Amazon Q and JetBrains AI, plus .aws, .ssh, Git and Azure/GCP credentials. It exfiltrates AES-GCM-encrypted ZIPs over HTTP POST to /gate/handshake, /gate/chunk and /gate/complete with User-Agent Microsoft-CryptoAPI/10.0 and custom X-Build-ID/X-Gate-Token/X-Chunk headers, and drops a clipper under C:\Microsoft\Vault. Hunt for non-AI processes reading AI tool credential files, proxy logs with these headers/paths, and rotate AI and cloud tokens on infected hosts.