A new virus steals passwords from ChatGPT, Claude, and crypto wallets

Cybersecurity experts at Symantec Threat Hunter have discovered a new version of the Aoki (Aokigahara) malware—an infostealer that steals session files from AI assistants, cookies, and crypto wallet data. The program’s name comes from the infamous Aokigahara Forest on the island of Honshu, known for mass suicides among teenagers. This malware first came to the researchers' attention this year, but the hacker group behind it has not yet been identified.

Aoki’s primary target is the login credentials and session files of AI code-writing tools: Claude, OpenAI Codex, Cursor, Codeium, and Gemini. Stolen API keys allow attackers to act on behalf of a legitimate developer—gaining access to repositories, cloud services, and CI/CD pipelines linked to the victim’s account. Such a key from a paid service can be resold or used at someone else’s expense.

At the same time, the program targets dozens of browser extensions for managing crypto wallets—MetaMask, Phantom, TronLink, Coinbase, Binance, Trust, Exodus, Brave, Ronin, Solflare, and over fifty others. Desktop wallets are also targeted: Exodus, Atomic, Electrum, Bitcoin Core, Monero, Litecoin, Dogecoin, Ledger Live, Binance, and TokenPocket, among others.

Separately, the infostealer scans the file system for documents whose names contain the words «mnemonic,» «recovery,» «privatekey,» «passphrase,» «backup,» «keystore,» «secret,» «12word,» «24word,» «wallet,» or «phrase.» This indicates a clear interest on the part of the attackers in others' cryptocurrency assets.

The program’s list of targets is not limited to cryptocurrencies and artificial intelligence. Aoki also collects data from the Chrome, Edge, Brave, Firefox, Opera, and Vivaldi browsers; password managers such as 1Password, Bitwarden, KeePass, and Dashlane; messaging apps like Discord and Telegram; and gaming platforms including Steam, Roblox, and Epic Games. In addition, the malware targets VPN services—OpenVPN, NordVPN, ProtonVPN, PIA, Surfshark, and Windscribe.

Researchers at Symantec Threat Hunter also found that the program detects which security measures are installed on the victim’s computer. This allows attackers to better tailor subsequent attacks to a specific system.

Meanwhile, experts at Socket Threat Research have identified 16 malicious Firefox browser extensions targeting users of the Rabby and OKX crypto wallets—their goal is to steal seed phrases and private keys.