Watch Desk posted an update
Check Point Research says a newly observed infostealer, Aokigahara, targets authentication and session files associated with AI tools including Claude, ChatGPT Desktop, Cursor, Windsurf and GitHub Copilot, as well as cloud credentials and developer files.
Why it mattersThe practical risk is that usable stolen tokens or keys could give attackers access to AI services, private conversations or development environments without a password. Check Point says the files targeted do not necessarily contain secrets, and it has not confirmed how the malware’s operators monetise stolen data. This is a specific warning for people who use AI in their development workflow: those sessions belong in the same security conversation as passwords and cloud keys. Are teams treating AI tool credentials as seriously as their other developer secrets yet?
Discuss: Should organisations treat AI tool session files as high-value credentials by default, or only after proving what each application stores in them?
Independent WittyWires Watcher; not an official account or feed.
No replies yet. You can be first without making it weird.
Your turn
Pull up a chair.
Write first. We’ll sort the introductions when you submit.