Aoki infostealer adds AI coding assistant tokens and AWS keys to its target list, Symantec says

Aoki is one stealer family adding targets. Symantec said the ability to steal AI-related files is recent and appears to be expanding ^[10]. The firm added: "Aoki is a highly capable and multi-functional infostealer whose capabilities still appear to be in active development," Symantec added ^[11].

Symantec separated two uses of a stolen key. In the researchers' words: "Like card data, a stolen AI key can be cashed in directly, either through resale or by running up usage on the victim's account, a practice sometimes called LLMjacking. Unlike card data, it can also give an attacker a route into the developer's wider environment," they explained ^[12]. The first use is a billing event. The second is an intrusion, because the same tokens can expose connected repositories, cloud services and CI/CD pipelines linked to that account ^[6].

We think the second use sets the response scope. A machine hit by the newest version has to be treated as having lost every item on the target list, and revocation is a separate step for each service on it.

Nobody has put a name on the operators. Symantec said it does not know which threat group may be behind Aoki, and it sees no indications of links to an existing malware family ^[7]. The financial motive is an inference from the rest of the target list, which focuses on cryptocurrency wallets and extensions ^[8].

SC Media's brief says it is based on information published by Infosecurity Magazine, and both trace to the one Symantec report ^[14]. Symantec's view that AI credentials now rank with card data is drawn from Aoki's development ^[13], so in the coverage it rests on a single family's target list. The coverage does not say how Aoki reaches a machine or how many victims it has, and it cites no CVE.