Date: 10/16/2026
Severity: High
Summary
Aoki (Aokigahara) is an infostealer whose recent versions target credentials and session files for AI coding assistants, including Claude, OpenAI Codex, Cursor, Codeium, Gemini, and GitHub Copilot. It steals API keys, authentication tokens, and configuration files that could enable attackers to impersonate legitimate users and access connected code repositories, cloud services, and CI/CD pipelines. The malware also harvests sensitive data from browsers, cryptocurrency wallets, password managers, messaging apps, gaming platforms, and VPN clients before exfiltrating the collected information to its C2 server.
Indicators of Compromise (IOC) List
Domains/URLs | magento.ink solidmonpe.com wibu-bau-bawang.online beraskencur.site |
IP Address | 45.88.188.140 198.23.185.234 138.68.244.146 185.21.136.6 72.61.89.179 104.194.158.65 109.224.53.140 162.243.175.162 154.93.37.228 141.164.58.87 88.80.150.232 88.119.167.57 173.212.247.23 104.248.131.53 147.182.224.216 93.93.112.57 192.210.183.17 |
Hash | 2bf7992e6260c1a98c709fa98ec766fb9f27692f338b30b43ac821b824fd849e
27d799ceadb570bfca890d4c2572314afe57eecf14083d30409da15afdfc4704
d73186cea6cf2cf3d48c09139a9d15521365aab675787b4e7a6f81767331c9fd
9e45830171eb607cf2c0fc80f5cc9cc3db39bb937032136990383a595f6f151e
c527b94e3d21824a674face4cd9d862e536b60ccbf54573839e3360f99188343
d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa
44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879
1505a3a727f8899b2ad343519f7bf9c438b8b802f8d6b854f5db3b52f857c76a
76c58fad4f70cf277a15a499b9a2151ac60e7a6b5c7a9ab684843dcc19f0d0a5
b1e82c6b0caea177e8bb71ad826867f509c65f0a43a651b50253e7c726566eac
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "dobeqnesmot.cc" or url like "dobeqnesmot.cc" or siteurl like "dobeqnesmot.cc" or domainname like "https://hjazfioe.surf/gate" or url like "https://hjazfioe.surf/gate" or siteurl like "https://hjazfioe.surf/gate" or domainname like "https://dobeqnesmot.cc/gate" or url like "https://dobeqnesmot.cc/gate" or siteurl like "https://dobeqnesmot.cc/gate" or domainname like "neihite.cc" or url like "neihite.cc" or siteurl like "neihite.cc" or domainname like "https://neihite.cc/gate" or url like "https://neihite.cc/gate" or siteurl like "https://neihite.cc/gate" or domainname like "hjazfioe.surf" or url like "hjazfioe.surf" or siteurl like "hjazfioe.surf" |
Detection Query 2 : | sha256hash IN ("c533570fd7cd7eaf5478317b03ea5750d03797aa4d11ebd96555b6cb708c63f2","73dbac0907e8a092cd978f2787ab1994946f5da1e08f2bdbd05ea52e80cdb896","e374f9ff5094f728528efa566c3de1b7fea7d95f497242a01fffa6c70b5eb768","6655b89b9885483d459c73f2a52e3cec121de5c5956172a8676a0f4c2de94999","2fb80e2221bd304e7cd5ac04169e71807ad92d19836f1aaf7885295cb90b2d94","0adc8e83b2416c275b1283916d70568faddeb6d718eb45f9addfb0938db245b3","6350dfee6975a9b159c5a57a3e97f757b0b02fd2dc708016fa6d7270e720c865","36af3acc78058023cdcf9307bc15be640be9425de97e574fdaf42d03d308725b","07bc2e3a1d14743cc44f1dc4c78d15d0f2b458b39fb48422b13df40fc662ba21","3b4547f0d7549274f366cd9568b3d302c1e80e1b89359da681beb47260ec7975","f779314b1a5a0b297fd4e2a5f9c1e40d387b3e7c401d42324b556a70f813840e","752c8e64af60960b85cf00e4bd34eb459e24b7939464f718ec18494df43b4b69","780bbdbb119befd4eb16e0c2ec0c64e7bedc1b53ce4f85804aea091a6e3af519","b590235493487c51f7050b341c9b2450e4f761ad6055207e4f6daf0cecae271c","0e38bd3c30a4ca08641240ce95b5b6ba593e131213ca1b2a28da4e0385fcabc4","bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf","039240551f88b0064b2615dffdc1321b1e7c58e3f617ac138a65a6d59400b331")
|
Reference:
Aoki Infostealer Targets AI Coding Assistants