Symantec
A globally known cybersecurity company that provides enterprise security products and services including threat intelligence, endpoint security and email security. Its threat hunter team regularly publishes malware research reports.
Timeline (last 90 days)
Historically, similar incidents (such as Symantec's CA problems) ultimately led to the complete removal of root certificates.
Symantec reported on October 15 that the Aoki infostealer has expanded its targets to AI coding tool credentials, including Claude's `.claude.json` and desktop cookies, Codex's `config.toml` and `.env` files, Cursor's local state database, tokens for GitHub Copilot, Gemini, Codeium, JetBrains AI Assistant and Kiro, as well as ChatGPT cookies and AWS credentials.
Symantec's threat hunter team released a report stating that an information-stealing trojan (Infostealer) named Aoki has added, in its latest samples, the ability to target the credential files of AI coding assistants.
Symantec's report does not explain how Aoki enters victims' machines, does not name the organization behind it, and does not give the number of victims.
Symantec's report does not describe any vulnerability in Claude Code, Codex, or any agent itself; Aoki merely reads files that already exist on disk.
Peter Norton 于 1990 年将 Norton Computing 卖给 Symantec
All Facts (6)
Historically, similar incidents (such as Symantec's CA problems) ultimately led to the complete removal of root certificates.
50%UnverifiedSymantec's threat hunter team released a report stating that an information-stealing trojan (Infostealer) named Aoki has added, in its latest samples, the ability to target the credential files of AI coding assistants.
50%UnverifiedSymantec's report does not explain how Aoki enters victims' machines, does not name the organization behind it, and does not give the number of victims.
50%UnverifiedSymantec's report does not describe any vulnerability in Claude Code, Codex, or any agent itself; Aoki merely reads files that already exist on disk.
50%UnverifiedPeter Norton 于 1990 年将 Norton Computing 卖给 Symantec
50%UnverifiedSymantec reported on October 15 that the Aoki infostealer has expanded its targets to AI coding tool credentials, including Claude's `.claude.json` and desktop cookies, Codex's `config.toml` and `.env` files, Cursor's local state database, tokens for GitHub Copilot, Gemini, Codeium, JetBrains AI Assistant and Kiro, as well as ChatGPT cookies and AWS credentials.
50%