Aokigahara Stealer Malware Targets Developer Keyrings and AI Assistants

# Aokigahara Stealer Malware Targets Developer Keyrings and AI Assistants

https://gcdradar.vercel.app/incidents/aokigahara-stealer-malware-targets-developer-keyrings-and-ai · AIR-2026-1593 · closed 2026-11-10

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Active malware campaign confirmed targeting developer and AI data.
- Fix status: No fix needed
- First reported: 2026-10-27
- AI role: AI-enabled attack
- Products: Aokigahara Stealer

## Summary

A new infostealer malware named Aokigahara is targeting developer keyrings and local AI assistant sessions to harvest sensitive business data from compromised endpoints. The campaign expands traditional infostealer tactics to target LLM session histories.

## What to do

Scan endpoints for Aokigahara stealer indicators and isolate compromised developer machines.

## Latest updates

- 2026-10-27: 'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants (https://darkreading.com/endpoint-security/aokigahara-stealer-developer-keyrings-ai-assistants)

## Sources

- 2026-10-27 Dark Reading: 'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants https://darkreading.com/endpoint-security/aokigahara-stealer-developer-keyrings-ai-assistants

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.