What happened
Check Point Research reported on October 23, 2026 that Aokigahara, a Windows infostealer seen in the wild and possibly an evolution of the Kamidere or Stygian malware, has a dedicated 'aisessions' module that copies sign-in, session and config files for Claude Code and Claude Desktop, Codex, ChatGPT Desktop, Cursor, Windsurf, GitHub Copilot, Gemini CLI, Amazon Q, Kiro and VS Code. A second module takes Git credentials, SSH keys and AWS, Azure and Google Cloud config files, and everything is zipped, encrypted and sent to the attackers. Symantec's Threat Hunter Team separately describes the same malware (as Aoki) and says the AI-targeting is a recent addition. (Check Point Research, Oct. 23, 2026)
Note on figures: Technical details come from security vendors Check Point Research and Symantec (Broadcom); no infection numbers or victim countries were published.
What it means for Canada: our assessment
Assessment: no Canadian victims are documented. Canadian software teams, fintechs and AI startups that give developers Claude Code, Cursor, Codex or Copilot on Windows laptops are exposed, because one infected machine can hand over AI accounts, code repositories and cloud keys at once.
- Sectors
- SaaS and AI startups · Banks and fintechs · Telecom · Consulting and IT services · Government digital teams
- Tools involved
- Claude Code / Claude Desktop · OpenAI Codex and ChatGPT Desktop · Cursor · Windsurf / Codeium · GitHub Copilot · Gemini CLI · Amazon Q and Kiro · AWS CLI and SSO cache · Git and SSH keys
- Canadian rules
- PIPEDA: if stolen tokens or cloud keys lead to personal information being accessed, report breaches with a real risk of significant harm to the OPC, notify affected people and keep a breach record
Quebec Law 25: record every confidentiality incident and report serious ones to the Commission d'accès à l'information
OSFI B-13: federally regulated financial institutions must manage identity and access risk, including privileged developer credentials, and report material technology or cyber incidents to OSFI
Bill C-8 / Critical Cyber Systems Protection Act (phasing in): designated operators in finance, telecom, energy and transport will owe cyber incident reports to the Cyber Centre
Assessment, not documented exposure. The malware targets files these tools write to any Windows machine, regardless of country, and Claude Code, Cursor, Codex and Copilot are widely used by Canadian developers. Neither Check Point nor Symantec names victim countries.
Takeaways for Canadian businesses
- BusinessOn any Windows machine flagged for infostealer activity, sign out of and revoke sessions for Claude, Codex/ChatGPT, Cursor, Windsurf, Copilot and Gemini, rotate any API keys kept in .codex\.env or similar files, and rotate the machine's SSH keys and Git credentials; Check Point lists .claude\credentials.json, .codex\auth.json and Cursor's state.vscdb among the stolen files.
- BusinessReplace long-lived keys in .aws\credentials with short-lived AWS IAM Identity Center (SSO) sessions, and apply the same to Azure and Google Cloud, so cloud config files copied from a laptop expire quickly.
- BusinessAdd an EDR rule or hunt for non-AI processes reading the AI-tool and .aws, .ssh and .git-credentials paths listed in Check Point's report, and load the indicators of compromise it publishes into your tools.
- BusinessKeep model API keys in a secrets manager or the OS credential store instead of plaintext .env files in user profiles, and scope AI-provider keys per project with spending limits so a stolen key is cheap to kill.
- BusinessReport a confirmed compromise to the Canadian Centre for Cyber Security (cyber.gc.ca), and to the OPC if personal information was exposed.
For the Canadian AI sector
AI assistant tokens are now treated by criminals like passwords and SSH keys, as resellable loot. For Canadian AI teams this lands in the same week as the LiteLLM and OpenCode key thefts: inference keys and agent sessions are a target on their own, and a stolen session can expose private chats, uploaded files and the code the agent can reach.
Written by AgentsNorth from the source below. General information, not legal or security advice.