Aoki Infostealer Targets AI Coding Assistant Credentials + CoGUI Phishing Kit Disruption: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Aoki Infostealer AI Assistant Credential Access
id: 9f1e2a7c-4b3d-4e5f-8a1b-aoki0001c001
status: experimental
description: Detects processes accessing AI coding assistant credential, session, or configuration stores targeted by the Aoki/Aokigahara infostealer (Claude, Codex, Cursor, Codeium, Gemini).
author: Security Arsenal Threat Intelligence
references:
  - https://www.security.com/threat-intelligence/aoki-infostealer-ai-targeting
date: 2026/10/15
modified: 2026/10/15
tags:
  - attack.credential_access
  - attack.t1555
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\.cursor\'
      - '\Cursor\User\'
      - '\.claude\'
      - '\.config\claude\'
      - '\.codex\'
      - '\.codeium\'
      - '\.gemini\'
      - '\Google\Gemini\'
  selection_tokens:
    TargetFilename|contains:
      - 'session'
      - 'token'
      - 'api_key'
      - 'credentials'
      - 'auth'
  filter_legit:
    Image|contains:
      - '\Cursor\'
      - '\Codeium\'
      - '\Anthropic\'
      - '\OpenAI\'
  condition: selection_paths and selection_tokens and not filter_legit
falsepositives:
  - AI assistant applications updating their own session files
  - Legitimate developer backup scripts
level: high
---
title: AiTM Phishing Domain Cluster Resolution - Fake Calendly and YAM Store Kits
id: 8d2b3c4e-5a6f-4b7c-9d0e-phish0002c02
status: experimental
description: Detects DNS resolution of known fake Calendly Meta Careers phishing domains and YAM Store (CoGUI/CoAceV/CoFish_Ws) kit infrastructure, plus TLD patterns associated with the campaign.
author: Security Arsenal Threat Intelligence
references:
  - https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-calendly-meta-careers-pages-steal-facebook-and-google-logins
  - https://www.proofpoint.com/us/blog/threat-insight/disruption-targets-major-chinese-language-phishing-kits-japanese-focus
date: 2026/10/15
modified: 2026/10/15
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.t1557
logsource:
  category: dns
detection:
  selection_domains:
    query|contains:
      - 'joinconnect.'
      - 'joinhire.'
      - 'joinquest.'
      - 'jointhetalent.'
      - 'lygyaou.com'
      - 'kenandy.shop'
      - 'new-app-haixing.com'
      - 'farradae.com'
      - 'ylhgkj.com'
      - 'neihite.cc'
  condition: selection_domains
falsepositives:
  - Threat researcher investigation
level: critical
---
title: Suspicious Spring Batch Job Submission on Tomcat - AI Agent Exploitation Pattern
id: 7c1a0b9d-2e3f-4a5b-8c7d-cairn003c003
status: experimental
description: Detects process spawning from Apache Tomcat consistent with exploitation of an exposed unauthenticated Spring Batch job-submission endpoint, as observed in the Cairn AI-agent-driven server takeover.
author: Security Arsenal Threat Intelligence
references:
  - https://reliaquest.com/blog/threat-spotlight-how-ai-agents-turned-one-exposed-endpoint-into-a-server-takeover
date: 2026/10/15
modified: 2026/10/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.privilege_escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\tomcat9.exe'
      - '\tomcat8.exe'
      - '\catalina.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\curl.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Spring Batch administrative jobs
  - Application deployment automation
level: high

// Security Arsenal Hunt: Aoki C2, phishing kit resolution, and Cairn intrusion infrastructure
let SuspiciousDomains = dynamic(["neihite.cc", "joinconnect.cfd", "joinconnect.works", "joinhire.cfd", "joinhire.info", "joinquest.cfd", "joinquest.info", "joinquest.works", "jointhetalent.cfd", "lygyaou.com", "kenandy.shop", "new-app-haixing.com", "farradae.com", "ylhgkj.com"]);
let CairnIPs = dynamic(["204.194.54.240", "204.194.55.189", "94.177.131.113"]);
union isfuzzy=true
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (SuspiciousDomains) or RemoteIP in (CairnIPs)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, ActionType
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where SHA256 in ("bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf", "752c8e64af60960b85cf00e4bd34eb459e24b7939464f718ec18494df43b4b69", "0adc8e83b2416c275b1283916d70568faddeb6d718eb45f9addfb0938db245b3", "6655b89b9885483d459c73f2a52e3cec121de5c5956172a8676a0f4c2de94999", "780bbdbb119befd4eb16e0c2ec0c64e7bedc1b53ce4f85804aea091a6e3af519", "2fb80e2221bd304e7cd5ac04169e71807ad92d19836f1aaf7885295cb90b2d94", "73dbac0907e8a092cd978f2787ab1994946f5da1e08f2bdbd05ea52e80cdb896")
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName
)
| sort by TimeGenerated desc

# Security Arsenal IOC Hunt — Aoki Infostealer & AI Credential Theft Artifacts
# Run elevated on suspected endpoints. Outputs findings to C:\IR\AokiHunt_$timestamp.csv

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

# 1. Registry Run-key persistence check
$runKeys = @(
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($key in $runKeys) {
    Get-ItemProperty -Path $key | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object {
            $findings += [PSCustomObject]@{ Type='RunKey'; Path=$key; Name=$_.Name; Value=$_.Value }
        }
    }
}

# 2. AI assistant credential/session artifact access staging
$aiPaths = @(
    "$env:USERPROFILE\.claude", "$env:USERPROFILE\.codex",
    "$env:USERPROFILE\.codeium", "$env:USERPROFILE\.gemini",
    "$env:APPDATA\Cursor", "$env:APPDATA\Codeium"
)
foreach ($p in $aiPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -File | Where-Object {
            $_.Name -match 'session|token|key|cred|auth' -and
            $_.LastAccessTime -gt (Get-Date).AddDays(-3) -and
            $_.LastAccessTime -gt $_.LastWriteTime
        } | ForEach-Object {
            $findings += [PSCustomObject]@{ Type='SuspiciousAIFileAccess'; Path=$_.FullName; Name=$_.Name; Value="Accessed $($_.LastAccessTime)" }
        }
    }
}

# 3. Known Aoki SHA256 hash sweep of common staging dirs
$aokiHashes = @('bf037920d39b85572ec7e53b51f09c28198c2c0afbc7c7d6cf639b1f047caebf',
'752c8e64af60960b85cf00e4bd34eb459e24b7939464f718ec18494df43b4b69',
'0adc8e83b2416c275b1283916d70568faddeb6d718eb45f9addfb0938db245b3',
'6655b89b9885483d459c73f2a52e3cec121de5c5956172a8676a0f4c2de94999',
'780bbdbb119befd4eb16e0c2ec0c64e7bedc1b53ce4f85804aea091a6e3af519',
'2fb80e2221bd304e7cd5ac04169e71807ad92d19836f1aaf7885295cb90b2d94',
'73dbac0907e8a092cd978f2787ab1994946f5da1e08f2bdbd05ea52e80cdb896')
foreach ($dir in @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA\Temp", "$env:USERPROFILE\Downloads")) {
    Get-ChildItem -Path $dir -Recurse -File -Depth 2 | ForEach-Object {
        $h = (Get-FileHash -Algorithm SHA256 $_.FullName).Hash.ToLower()
        if ($aokiHashes -contains $h) {
            $findings += [PSCustomObject]@{ Type='AokiHashMatch'; Path=$_.FullName; Name=$_.Name; Value=$h }
        }
    }
}

# 4. Active connections to known C2 / phishing infrastructure
Get-NetTCPConnection -State Established | Where-Object {
    $_.RemoteAddress -in @('204.194.54.240','204.194.55.189','94.177.131.113')
} | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    $findings += [PSCustomObject]@{ Type='MaliciousConnection'; Path=$proc.Path; Name=$proc.Name; Value="$($_.RemoteAddress):$($_.RemotePort)" }
}

# 5. Scheduled tasks created in the last 7 days (persistence)
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } | ForEach-Object {
    $findings += [PSCustomObject]@{ Type='RecentScheduledTask'; Path=$_.TaskPath; Name=$_.TaskName; Value=$_.State }
}

New-Item -Path 'C:\IR' -ItemType Directory -Force | Out-Null
$out = "C:\IR\AokiHunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
$findings | Export-Csv -Path $out -NoTypeInformation
Write-Host "[+] Hunt complete. $($findings.Count) findings written to $out"