AOKIGAHARAAokigahara

Aokigahara is a Windows infostealer reported by Check Point Research in October 2026. According to Check Point, an earlier version may have been known as Kamidere or Stygian, and its YARA rule matches both the aokigahara and kamidere strings. Besides the usual targets (Chromium and Firefox credentials and cookies, desktop and browser-extension crypto wallets, Discord, Telegram, Steam and gaming launchers, Outlook and Thunderbird, VPN, FTP/SFTP and password-manager data, screenshots, clipboard, file grabbing), it has dedicated handlers for AI and developer tools. The aisessions and ide handlers collect authentication, session and configuration files from Claude Code/Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, Kiro, GitHub Copilot/VS Code, Gemini CLI, JetBrains AI Assistant and Amazon Q, as well as Git credentials, SSH keys and AWS/Azure/Google Cloud credentials. It can also drop a separate clipper component. Its configuration, stored AES-256-CBC encrypted in a .stgcfg section, enables modules through a bitmask, and optional checks stop execution on CIS keyboard or UI languages and on analysis environments. Stolen data is uploaded as AES-256-GCM encrypted ZIP chunks to /gate/handshake, /gate/chunk and /gate/complete endpoints, with an X25519 key exchange. No threat actor has been attributed.