Infostealer Targets AI Coding Assistants: .claude.json and config.toml in the Crosshairs

Title

Infostealer Targets AI Coding Assistants: .claude.json and config.toml in the Crosshairs

Meta Description

A Symantec report reveals that the Aoki infostealer now steals credentials from AI coding assistants, explicitly naming .claude.json and Codex's config.toml. This article explains what these files actually contain, two commands to check your own machine, remediation steps to move tokens out of plaintext files, and a rotation checklist after infection.

Article Content

AI coding assistants are becoming malware's new prey. Symantec's threat hunter team has published a report stating that a new sample of an infostealer called Aoki has added the ability to target credential files for AI coding assistants, specifically naming configuration files such as .claude.json and Codex's config.toml. For developers who use Claude Code, Codex, Cursor, and similar tools daily, this is no longer a distant security news story—it's a local file checklist that needs to be verified immediately.

What Symantec Found—and What It Didn't Say

According to Symantec's report, the new Aoki sample steals credential and session files from AI coding assistants, covering tools such as Claude, OpenAI's Codex, Cursor, Codeium, and Gemini. By filename, this includes .claude.json, Claude desktop cookies, ChatGPT cookies, and Codex's config.toml and .env files. In addition, tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant, and Kiro, as well as AWS credentials, are also on its list.

The report notes that this capability was added only recently: earlier versions of Aoki did not target AI-related files. At the same time, it still retains traditional theft targets—dozens of browsers, crypto wallets, password managers, communication apps, and VPN and FTP clients.

A detail worth noting is the gap the report leaves. It does not explain how Aoki gets onto victim machines, does not name the organization behind it, and does not provide victim counts (Infosecurity Magazine's coverage does not add this information either). More importantly, the report does not describe any vulnerability in Claude Code, Codex, or any agent itself: Aoki simply reads files that already exist on disk after you have run it under your own identity. This determines the direction of all subsequent protective actions—the problem is not the tool itself, but in what form and where credentials are stored.

What These Files Actually Contain

Different agents store login state differently, and official documentation specifies the locations.

Claude Code. On macOS, login information is stored in the encrypted macOS Keychain; on Linux it's ~/.claude/.credentials.json (file permissions 0600), and on Windows it's %USERPROFILE%\.claude\.credentials.json. Anthropic's documentation also notes that when the Keychain refuses writes (for example, when the Keychain is locked in an SSH session), macOS falls back to this file. The ~/.claude.json that Symantec names is where Claude Code saves local or user-level MCP server configuration. The documentation recommends using local scope for "credential servers you don't want in version control"—this keeps tokens out of git, but doesn't stop them from staying in your home directory.

Codex. OpenAI's documentation explicitly states that Codex caches login information in the plaintext file ~/.codex/auth.json, or stores it in OS-specific credential storage, and warns: "Treat ~/.codex/auth.json like a password: it contains access tokens." Symantec's list mentions Codex's config.toml rather than auth.json. In config.toml, the env table for stdio MCP servers sets environment variables for that server process, so secrets written directly there as literal values are sitting in plaintext in the file.

One detail worth noting: the exposure surface of the two files is not the same. auth.json stores the login token itself, while config.toml may contain third-party API keys you've pasted in yourself. The former is "stored by the platform for me," while the latter is often "hardcoded because I was lazy"—the latter is precisely more common and more easily overlooked.

Infostealer is malware whose primary goal is to steal sensitive data such as user credentials, session tokens, browser-saved passwords, cookies, and crypto wallets. Unlike ransomware, infostealers typically do not encrypt or destroy files; instead, they silently exfiltrate data to attacker-controlled C2 servers. Typical distribution channels include phishing email attachments, installers disguised as cracked software, malvertising, and supply chain attacks. Because stolen data can be monetized directly on underground markets, infostealers have become one of the highest-return malware categories in the current cybercrime ecosystem. Aoki belongs to this category, and its new sample has added AI coding assistant configuration files to its theft list.

Two Commands to Check Your Local Files

No need to guess. The following commands only read and print: first list whether credential files exist, then search the two configuration files named by Symantec for token-like strings:

ls -l ~/.claude/.credentials.json \
  ~/.codex/auth.json 2>/dev/null

grep -nE 'Bearer |sk-|ghp_|github_pat_|_KEY|_TOKEN' \
  ~/.claude.json ~/.codex/config.toml 2>/dev/null

On Linux, ls listing .credentials.json is the expected location for Claude Code login; on macOS, its presence means the Keychain write failed and login fell back to the file. The presence of auth.json indicates that Codex is using file-based caching for login state; the next section explains how to change this.

The grep output will deliberately be "noisy": variable names like GITHUB_TOKEN with no value following are normal; a long literal value immediately following is what needs attention. It's recommended to run the same grep on .env files in your projects, since Symantec's list also includes .env.

Treat what you find as a cleanup checklist, not as evidence of infection. These files being readable by your user is a normal state; risk only materializes when malicious software runs under your identity—which is exactly the scenario the report describes.

Moving Tokens Out of Plaintext Files

For Codex, the fix is just a setting. cli_auth_credentials_store controls where the CLI caches credentials, with options file, keyring, auto, or ephemeral. keyring uses the OS credential store and fails directly if it's unavailable:

**OS credential store (keyring)** is an encrypted credential management service provided by the operating system: Keychain on macOS, typically provided by the Secret Service API (GNOME Keyring or KWallet) on Linux, and Credential Manager on Windows. When an application hands keys to the system credential store, data at rest is encrypted by the OS, and access typically requires an unlocked user session. Compared to plaintext files, keyring raises the bar for attackers trying to read disk files directly, but it is not absolutely secure: malicious software running as the user may still request access through system APIs. Therefore, keyring is one layer in reducing exposure surface, not the end point—source-level rotation remains a necessary action after credential compromise.

**LLMjacking** refers to attackers stealing others' cloud accounts or AI service credentials to call large language model APIs under the victim's identity and quota. Attackers' motivations include obtaining expensive model inference for free, reselling API access, or inflating usage to cause the victim's bills to skyrocket. Since LLM APIs are billed per token at non-trivial unit prices, stolen credentials can generate significant costs in a short time. LLMjacking typically works in tandem with infostealers: first steal cloud service or AI platform API keys, then use them to call models. This aligns with Symantec's report judgment that "stolen AI keys can be monetized directly."
# ~/.codex/config.toml
cli_auth_credentials_store = "keyring"

After making the change, run codex logout and then codex login; the next token will land in the keyring instead of auth.json.

For MCP servers, stop pasting literal tokens. Codex's bearer_token_env_var accepts the name of an environment variable rather than the token itself. For Claude Code, if a remote server uses OAuth with pre-configured client credentials, the client secret is stored in the system keychain (macOS) or a credential file, not in the configuration file.

But environment variables are not a safe. If you export the key in ~/.zshrc, you've just moved the plaintext to another file. Claude Code's own API key can be set via apiKeyHelper—it runs a script that returns the key, letting the key come from the keychain rather than a shell profile.

What to Do If You Suspect Your Machine Is Infected

Rotation takes priority over cleanup. Once a token leaves the machine, deleting files is useless. Logout also has limitations: it clears the local copy, and neither vendor's documentation says it can kill copies that have already been taken. The truly effective step is revoking API keys at the source.

• Anthropic: Revoke and reissue API keys in the Claude Console; run /logout in Claude Code and log in again. If you log in with a Pro or Max plan and suspect compromise, contact Anthropic support to ask how to terminate other sessions.
• Codex: codex logout clears locally stored credentials; rotate OpenAI API keys at platform.openai.com, and consult OpenAI support about ChatGPT logins that may have been copied.
• GitHub: Revoke personal access tokens in token settings, and check authorized OAuth apps and GitHub Apps. Symantec's list includes Copilot tokens.
• AWS: Symantec also lists AWS credentials; corresponding access keys should also be rotated.
• The rest of the list (Cursor, Gemini, JetBrains AI Assistant, Kiro, and Claude desktop and ChatGPT browser sessions): Log out all sessions in each account's settings, then log in again.

If you need to do network-side investigation, Symantec has published 17 file hashes and the following C2 domains, which can be compared against DNS logs: dobeqnesmot[.]cc, hjazfioe[.]surf, neihite[.]cc.

What This Means for the AI Coding Tool Ecosystem

This incident marks a turning point: coding agent tokens now have independent economic value. Symantec explains this directly in its report—stolen tokens "allow attackers to perform operations under a legitimate user's identity and API quota" and can reach associated repositories, cloud services, and CI/CD pipelines; "stolen AI keys can be monetized directly, whether by resale or by burning usage on the victim's account." Infosecurity Magazine connects the latter to LLMjacking (theft of LLM quota).

In other words, an agent's token is essentially an identity. Whoever holds it can run the agent in your name, spend your quota, and touch your repositories. This also explains why attackers have added AI configuration files to their lists—like browser passwords and crypto wallets, they are assets that can be cashed out directly.

For developers, the practical conclusion is not complicated: don't assume tool vendors will cover for you—the form in which credentials ultimately exist on disk is your own choice. Switching Codex to keyring, replacing literal tokens with environment variable names, and configuring apiKeyHelper for Claude Code are all low-cost actions that can close off the most common problem of "plaintext sitting in your home directory." What remains is the habit of regular self-checks and rotation.

One-line Summary

New Aoki infostealer sample steals AI coding assistant credentials; developers need to check local files and rotate keys.

Paragraph Summary

A Symantec report says a new Aoki infostealer sample now targets credential files for AI coding assistants, including Claude Code's .claude.json, Codex's config.toml and .env, and tokens for Cursor, Codeium, Gemini, plus AWS credentials. The report doesn't explain the intrusion vector or victim counts, but clearly states the problem is not agent vulnerabilities: Aoki reads files already on disk after running as the user. The article recommends developers use commands to self-check credential files, set Codex's cli_auth_credentials_store to keyring, replace literal tokens with environment variable names, configure apiKeyHelper for Claude Code, and prioritize revoking and rotating API keys at the source when infection is suspected. An agent's token is essentially an identity; if stolen, it can be used to operate repositories, cloud services, and CI/CD, or resold to burn usage.