New 'Aokigahara' stealer goes after AI assistant sessions

A newly identified infostealer called 'Aokigahara' is targeting AI assistant sessions and developer keyrings alongside the usual haul of credentials, according to a report published by Dark Reading on 27 October 2026.

Infostealers are malware that quietly harvest saved logins, tokens and files from a machine the attacker has already compromised. What makes Aokigahara notable, according to the report, is where it looks. Rather than limiting itself to browser password stores, the malware goes after AI tooling, developer infrastructure and sensitive business data. Dark Reading described the result as a "forest" of AI sessions, business data and developer infrastructure exposed from a single compromised endpoint.

No vendor or product has been named as the source of the problem, and the report does not attribute the malware to a specific operator. There is no public figure for how many organisations have been affected. The incident is at the reported stage, meaning the behaviour has been documented by researchers rather than confirmed through a vendor advisory or a disclosed breach at a named company.

The focus on AI assistant sessions matters because of what those sessions hold. A live session with an AI assistant can carry authentication tokens, conversation history and, in agentic setups, standing permissions to act on a user's behalf. Stealing a session is not the same as stealing a password: it can hand an attacker an already-authenticated path into whatever the assistant is connected to, without triggering a fresh login.

Developer keyrings are a similar problem in a different wrapper. A keyring is the local store an operating system or development tool uses to hold secrets such as API keys, cloud credentials and signing material so a developer does not have to type them repeatedly. On a developer workstation, that store often sits next to source code, build pipelines and production access. Dark Reading characterised the malware's reach as extending to developer infrastructure from the one machine it lands on.

Taken together, the two targets describe a shift in the infostealer playbook. The traditional model monetises stolen logins in bulk. The model described in this report collects the artefacts that AI-assisted development leaves lying around on disk: tokens, session files and secrets that were created for convenience and are rarely rotated. Those artefacts are increasingly where the real access lives.

The practical implications for defenders follow from the target list rather than from any specific technical detail released so far. Session tokens for AI assistants should be treated as credentials and given the same expiry and revocation handling. Keyring contents on developer machines are high-value material and worth inventorying. Endpoint compromise on a developer laptop should be assumed to mean credential compromise across everything that laptop could reach.

The Dark Reading report does not include indicators of compromise, a delivery mechanism, or details of how the malware locates and extracts AI session data. It also does not identify any affected organisations. Further technical analysis would be needed before defenders can build detections specific to this family, and nothing published so far suggests a patch or vendor fix is applicable, since the malware exploits data that applications legitimately store on the endpoint rather than a flaw in any one product.