Symantec’s Threat Hunter team identified a new variant of the Aoki (Aokigahara) infostealer, disclosed around October 16, 2026, that now searches infected machines for local credentials and session data tied to AI coding tools. The malware targets files such as Claude’s local configuration file, Claude and ChatGPT browser cookies, OpenAI Codex’s configuration file, and .env files, exfiltrating stolen data to a command-and-control server. Earlier versions of Aoki did not target AI-related files; the updated variant also continues to harvest browser passwords, cryptocurrency wallets, and VPN and password-manager data. No specific victim count or financial loss has been reported.