# Infostealer riding the AI Train

Aokigahara infostealer in the wild harvests AI tool credentials, sessions, cloud keys, SSH keys and browser data, exfiltrating AES-GCM-encrypted ZIPs to a C2 gate.

- Payout: Real-world hack
- Program: Aokigahara
- Analysis by: antoniost@checkpoint.com
- Disclosed: 2026-10-23
- Write-up quality: 7/10
- Original: https://research.checkpoint.com/2026/infostealer-riding-the-ai-train/
- Library page: https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-infostealer-riding-the-ai-train
- Tags: area:os domain:desktop impact:data-leak impact:internal-access kind:incident platform:threat-intel tech:aws tech:llm tech:windows technique:reverse-engineering vuln:secrets-leak

**Target:** Windows endpoint: AI desktop/CLI apps, IDEs, browsers, wallets, cloud CLI configs
**Root cause:** Malware stores AI/developer credentials and session files in predictable per-user paths (e.g. .claude/credentials.json, .codex/auth.json, .aws/credentials, .ssh keys) that are plaintext or trivially decryptable, so a stealer with hardcoded path lists can grab them wholesale.
**Steps:**
1. Decrypt .stgcfg config: magic STGC, 4-byte len, 16-byte IV, AES-256-CBC ciphertext; derive key via seed-mixing routine (seed ^= seed>>(8*(i&3)); seed*=0x01000193; seed^=seed>>16).
2. Read module_mask to select handlers (aisessions, ide, browsers, wallets, etc.).
3. aisessions handler reads `%s\.claude\credentials.json`, `%s\.codex\auth.json`, `%s\.aws\credentials`, `%s\.aws\sso\cache`, `%s\.gemini-cli-workspace-master-key`, Cursor/Windsurf `state.vscdb`, Copilot `hosts.json`, etc.
4. ide handler grabs `.ssh` private keys, Git credential files, AWS/Azure/GCP configs.
5. POST /gate/handshake with 32-byte X25519 pubkey, X-Build-ID, X-Gate-Token, X-Session, X-HWID headers.
6. Derive AES key = SHA-256(X25519 shared secret || "aokigahara"); for each module ZIP: POST /gate/chunk with body `\x00\x00\x00\x00`+8 random bytes (nonce) || AES-256-GCM ciphertext || 16-byte tag, headers X-Chunk and X-Chunk-Index.
7. POST /gate/complete with body `COMPLETE`.
8. Anti-analysis: skip if keyboard layout/UI language in bitmask 0x6C0400C8601 (RU/UA/BY/etc.), or if PEB debug flags, DR0-DR3, CPUID hypervisor, VM registry/processes, or usernames like sandbox/test/admin detected.
**How found:** Malware reverse engineering: identified .stgcfg section with STGC magic, reversed the seed-based AES key derivation and control-flow-flattened config decryptor, then enumerated handler dispatch table and hardcoded target paths to map collection scope.
**Exploitation:** Delivered as Windows malware; on execution decrypts embedded config, runs enabled collection modules against hardcoded paths, packages each module's output as a ZIP, encrypts with AES-256-GCM under an X25519-derived key, and uploads chunks to the C2 /gate endpoints. Stolen AI/cloud/SSH credentials enable account takeover of paid AI services, source repos, and cloud environments.
**Escalation:** Chains credential theft across AI tools, IDEs, cloud CLIs and SSH keys to pivot from a single workstation into developer repos and cloud infrastructure; clipper component dropped under C:\Microsoft\Vault for wallet address substitution.
**Insight:** AI CLI/desktop tools persist long-lived tokens and master keys in predictable dotfile paths (.claude/credentials.json, .codex/auth.json, .gemini-cli-workspace-master-key, Cursor state.vscdb) — treat these as credential stores equivalent to .aws/credentials when auditing endpoint exposure or building detections.