A newly observed infostealer called Aokigahara is going after the places developers keep their most valuable secrets: AI coding assistants, developer workstations, and cloud credentials. The Aokigahara infostealer AI coding tools campaign is a reminder that attackers increasingly care less about your password and more about the tokens, keys, and session files your devices quietly store.

The public details on this malware are limited, so this post sticks to what has been reported and explains why the technique matters.

How Aokigahara steals logins and session tokens

According to the reporting, Aokigahara is an infostealer, a type of malware that runs on an infected machine, collects sensitive files and stored data, and sends them to an attacker. Its reported targets include AI coding assistants, developer workstations, and cloud credentials, with the headline items being login tokens, SSH keys, and cloud access material.

Infostealers do not need to break into an account the hard way. Once malware is running on a device, it can read files that applications leave behind to keep you signed in. That is why a single infected laptop can expose several services at once: the browser, the code editor, the command line, and any cloud tooling configured on the same machine.

The source article is brief, so we cannot say how Aokigahara is delivered or how many people have been affected. We will not guess. What is clear is the category of data it wants, and that category is worth understanding on its own.

Why developers and cloud accounts are high-value targets

Developer machines are unusually rich. A typical workstation may hold SSH keys for servers and code repositories, cloud access credentials, API tokens, and sign-in state for AI assistants. One compromised device can therefore be a stepping stone into source code, infrastructure, and production systems.

AI coding assistants add another layer. They are often authenticated for long periods and linked to private code and projects. If an attacker obtains the token that proves you are signed in, they may be able to act as you without ever seeing your password.

This fits a broader pattern of attackers turning their attention to AI development tools. For wider context, see our coverage of how Claude Code was weaponized in an autonomous ransomware attack, which shows how these tools can be abused from a different direction.

Why stolen session tokens bypass MFA

Multi-factor authentication (MFA) protects the moment of login. It asks for something beyond your password, such as a code or a prompt. But after you pass that check, the service issues a session cookie or token that says, in effect, this user is already verified.

If malware copies that token, an attacker can present it to the service and skip the login step entirely. There is no password to guess and no code to intercept, because the proof of verification has already been stolen. SSH keys work similarly: a private key on disk can authenticate to a server without any second factor, unless the key itself is protected.

This does not mean MFA is useless. It still blocks a large share of account takeovers, especially those that rely on leaked passwords. It simply cannot help once the device itself is compromised and the tokens are lifted from it. That is why device hygiene matters as much as strong passwords.

What This Means For You

If you write code, administer servers, or use AI assistants with access to private projects, treat your workstation as a vault. The secrets stored on it are often worth more than any single password.

Even if you are not a developer, the lesson applies. Browsers store session cookies, and malware that reads them can hijack accounts that were protected by MFA. The risk comes from the device being infected, so keeping that device clean is part of protecting every account you use on it.

Practical steps to protect your credentials

  • Audit where secrets live. Check for API keys, tokens, and credentials in plain text files, environment files, shell history, and project folders. Move them into a dedicated secrets manager or your operating system's secure storage.
  • Protect SSH keys. Use a passphrase on private keys, and consider hardware-backed keys where possible so the key cannot simply be copied.
  • Rotate anything that may be exposed. If you suspect a device was infected, revoke and reissue tokens, SSH keys, and cloud credentials from a clean device. Sign out of active sessions everywhere.
  • Switch to phishing-resistant MFA. Passkeys and hardware security keys resist phishing far better than SMS or app codes, though no MFA fully solves token theft from an infected machine.
  • Keep devices clean. Install updates, use reputable endpoint protection, avoid running unverified scripts or packages, and be cautious with downloads and email attachments.
  • Limit privileges and lifetimes. Use short-lived tokens and the narrowest permissions that work, so a stolen credential is worth less.

The takeaway

The Aokigahara infostealer AI coding tools campaign shows that attackers are following the credentials, and those now sit in AI assistants and developer environments as much as in password fields. Start by auditing where your secrets are stored, rotate any tokens and keys that might have been exposed, and move to phishing-resistant MFA. For more on how attackers are turning AI development tools to their advantage, read our report on AI coding tools being abused in attacks.