Aokigahara Stealer: Detecting and Remediating the AI Session & Developer Keyring Threat

---
title: Aokigahara Stealer - Developer Keyring Access
id: 8f3a2b1c-9d4e-4f5a-8b6c-7e8f9a0b1c2d
status: experimental
description: Detects suspicious access to SSH keys, cloud credentials, and AI assistant session files by non-system processes. Aokigahara targets these specific paths for credential exfiltration.
references:
  - https://www.darkreading.com/endpoint-security/aokigahara-stealer-developer-keyrings-ai-assistants
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1552.004
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\\.ssh\\id_rsa'
      - '\\.ssh\\id_ed25519'
      - '\\.aws\\credentials'
      - '\\.azure\\'
      - '\\.config\\gcloud\\'
      - '\\AppData\\Roaming\\Code\\User\\globalStorage\\github.copilot'
      - '\\AppData\\Roaming\\Cursor\\'
      - '\\.gnupg\\secring.gpg'
  selection_process:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_paths and selection_process
falsepositives:
  - Legitimate administrative scripts accessing cloud credentials
  - IDE processes accessing their own configuration files (should be excluded via path whitelisting)
level: high
---
title: Aokigahara Stealer - Suspicious Process Hollowing
description: Identifies potential process hollowing activity commonly used by Aokigahara to inject into legitimate Windows processes for evasion.
id: 7b4c5d6e-8f9a-4b3c-9d2e-1f0a2b3c4d5e
status: experimental
references:
  - https://attack.mitre.org/techniques/T1055/012/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1055.012
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\outlook.exe'
      - '\powershell.exe'
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\dllhost.exe'
    CommandLine|contains:
      - 'comsvcs.dll'
      - 'MiniDump'
      - 'shell32.dll'
      - 'Control_RunDLL'
  condition: selection
falsepositives:
  - Administrative use of rundll32 for system maintenance
  - Software installations using COM objects
level: medium
---
title: Aokigahara Stealer - AI Assistant Configuration Access
description: Detects unauthorized access to AI coding assistant configuration and session storage directories, a key target of the Aokigahara stealer.
id: 3c4d5e6f-7a8b-4c5d-8e9f-0a1b2c3d4e5f
status: experimental
references:
  - https://www.darkreading.com/endpoint-security/aokigahara-stealer-developer-keyrings-ai-assistants
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\AppData\Roaming\Code\User\globalStorage\github.copilot\'
      - '\AppData\Roaming\Cursor\User\globalStorage\'
      - '\AppData\Roaming\Claude\'
      - '\AppData\Roaming\ChatGPT\'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\python.exe'
      - '\node.exe'
      - '\unknown.exe'
  condition: selection
falsepositives:
  - VS Code or Cursor updating their own configurations (exclude by process path)
  - User manually editing settings via text editor
level: high

// Hunt for Aokigahara Stealer Activity - Developer Credential Access
let SensitivePaths = dynamic([
    "\\.ssh\\id_rsa",
    "\\.aws\\credentials",
    "\\.gnupg\\secring.gpg",
    "\\github.copilot",
    "\\Cursor\\User\\globalStorage",
    "\\AppData\\Roaming\\Claude"
]);
let SuspiciousProcesses = dynamic([
    "powershell.exe",
    "cmd.exe",
    "rundll32.exe",
    "regsvr32.exe",
    "wscript.exe",
    "cscript.exe",
    "mshta.exe",
    "python.exe",
    "node.exe"
]);
let ExfilDomains = dynamic([
    "api.telegram.org",
    "discord.com/api/webhooks",
    "pastebin.com",
    "transfer.sh"
]);
// File Access Events
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where FolderPath has_any (SensitivePaths)
| where InitiatingProcessFileName in~ (SuspiciousProcesses)
| project 
    TimeGenerated,
    DeviceName,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    FileName,
    FolderPath,
    SHA256,
    AccountName
| join kind=inner (
    // Correlate with Process Creation
    DeviceProcessEvents
    | where TimeGenerated > ago(24h)
    | where FileName in~ (SuspiciousProcesses)
    | project 
        DeviceName,
        ProcessId,
        FileName,
        ProcessCommandLine,
        ParentProcessName,
        TimeGenerated
) on DeviceName
| extend ProcessTree = strcat(ParentProcessName, " -> ", FileName)
| project 
    TimeGenerated,
    DeviceName,
    ProcessTree,
    InitiatingProcessCommandLine,
    FileName,
    FolderPath,
    AccountName
| join kind=leftouter (
    // Check for Network Exfiltration
    DeviceNetworkEvents
    | where TimeGenerated > ago(24h)
    | where RemoteUrl has_any (ExfilDomains) or RemoteIP has_any (ExfilDomains)
    | project 
        DeviceName,
        RemoteUrl,
        RemoteIP,
        InitiatingProcessFileName,
        TimeGenerated
) on DeviceName, $left.InitiatingProcessFileName == $right.InitiatingProcessFileName
| summarize 
    FileAccessCount = count(),
    FilesAccessed = make_set(FileName),
    NetworkConnections = make_set(RemoteUrl)
    by DeviceName, ProcessTree, AccountName, bin(TimeGenerated, 1h)
| where FileAccessCount > 3 // Threshold to reduce noise
| sort by FileAccessCount desc

-- Hunt for Aokigahara Stealer Artifacts
-- Checks for suspicious processes accessing developer credentials and AI tools

SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    ParentPid
FROM pslist()
WHERE 
    -- Suspicious process names commonly used for injection or execution
    (Name =~ '(powershell|cmd|rundll32|regsvr32|wscript|cscript|mshta|python|node)'
    AND 
    -- Command lines referencing sensitive paths or encoding
    (CommandLine =~ 'id_rsa|\.aws|credentials|secring|github.copilot|Cursor.*globalStorage'
    OR CommandLine =~ 'FromBase64String|DownloadString|IEX|Invoke-Expression'
    OR CommandLine =~ '-enc|-e |-ec'))
    OR
    -- Processes running from temp directories (common for droppers)
    (Exe =~ 'AppData\\Local\\Temp|\\\\Temp\\\\|/tmp/'
    AND Name =~ '\.exe$|\.dll$')
ORDER BY CreateTime DESC

-- Search for staged credential archives (Aokigahara often compresses before exfil)
SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime
FROM glob(globs='C:\\Users\\*\\AppData\\Local\\Temp\\*.zip')
WHERE Mtime > ago(24 * 3600) -- Last 24 hours
AND Size > 1024 -- Non-empty files
ORDER BY Mtime DESC

# Aokigahara Stealer Detection and Remediation Script
# Run with Administrative privileges on suspected endpoints

Write-Host "[+] Aokigahara Stealer Response Script" -ForegroundColor Cyan
Write-Host "[+] Checking for indicators of compromise..." -ForegroundColor Yellow

# 1. Check for suspicious processes accessing credential paths
$suspiciousPaths = @("\.ssh\", "\.aws\", "\.gnupg\", "github.copilot", "Cursor", "Claude")
$processes = Get-Process | Where-Object {
    $_.Path -match "powershell|cmd|rundll32|regsvr32|python|node" -and
    $_.CommandLine -match ($suspiciousPaths -join "|")
} 2>$null

if ($processes) {
    Write-Host "[!] Suspicious processes detected accessing credential paths:" -ForegroundColor Red
    $processes | Select-Object Name, Id, Path, CommandLine | Format-Table -AutoSize
    
    # Optional: Kill suspicious processes (uncomment for active response)
    # $processes | Stop-Process -Force
}

# 2. Check for recent modifications to sensitive files
Write-Host "[+] Checking for recent access to sensitive developer files..." -ForegroundColor Yellow
$sensitiveFiles = @(
    "$env:USERPROFILE\.ssh\id_rsa",
    "$env:USERPROFILE\.aws\credentials",
    "$env:APPDATA\Code\User\globalStorage\github.copilot",
    "$env:APPDATA\Cursor\User\globalStorage"
)

foreach ($file in $sensitiveFiles) {
    if (Test-Path $file) {
        $item = Get-Item $file
        $lastWrite = $item.LastWriteTime
        $lastAccess = $item.LastAccessTime
        $recentThreshold = (Get-Date).AddHours(-24)
        
        if ($lastWrite -gt $recentThreshold -or $lastAccess -gt $recentThreshold) {
            Write-Host "[!] Recent access detected: $file" -ForegroundColor Red
            Write-Host "    Last Write: $lastWrite" -ForegroundColor Gray
            Write-Host "    Last Access: $lastAccess" -ForegroundColor Gray
        }
    }
}

# 3. Check network connections to common exfil endpoints
Write-Host "[+] Checking for suspicious network connections..." -ForegroundColor Yellow
$suspiciousPorts = @(443, 8443, 8080)
$connections = Get-NetTCPConnection | Where-Object {
    $_.State -eq "Established" -and
    $_.RemotePort -in $suspiciousPorts -and
    $_.OwningProcess -in (Get-Process | Where-Object {$_.Name -match "powershell|cmd|python|node"}).Id
}

if ($connections) {
    Write-Host "[!] Suspicious outbound connections detected:" -ForegroundColor Red
    foreach ($conn in $connections) {
        $proc = Get-Process -Id $conn.OwningProcess
        Write-Host "    $($proc.Name) (PID: $($conn.OwningProcess)) -> $($conn.RemoteAddress):$($conn.RemotePort)" -ForegroundColor Red
    }
}

# 4. Immediate containment recommendations
Write-Host "`n[CONTAINMENT ACTIONS REQUIRED]" -ForegroundColor Magenta
Write-Host "1. Rotate ALL credentials stored on this endpoint immediately:" -ForegroundColor White
Write-Host "   - SSH Keys (generate new keypairs)" -ForegroundColor Gray
Write-Host "   - AWS/Azure/GCP access keys" -ForegroundColor Gray
Write-Host "   - GitHub/GitLab personal access tokens" -ForegroundColor Gray
Write-Host "   - AI Assistant API keys (Copilot, OpenAI, Anthropic)" -ForegroundColor Gray
Write-Host "   - Package manager tokens (npm, PyPI, NuGet)" -ForegroundColor Gray

Write-Host "`n2. Revoke active sessions:" -ForegroundColor White
Write-Host "   - Invalidate GitHub Copilot sessions via GitHub settings" -ForegroundColor Gray
Write-Host "   - Revoke ChatGPT/Claude API keys if stored locally" -ForegroundColor Gray
Write-Host "   - Clear browser cookies for AI services" -ForegroundColor Gray

Write-Host "`n3. Isolate this endpoint from the network until forensic analysis is complete" -ForegroundColor White

# 5. Export process list for forensic analysis
Write-Host "`n[+] Exporting process list for forensic analysis..." -ForegroundColor Yellow
$exportPath = "$env:TEMP\aokigahara_forensics_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
Get-Process | Select-Object Name, Id, Path, CommandLine, StartTime | 
    Export-Csv -Path $exportPath -NoTypeInformation
Write-Host "    Exported to: $exportPath" -ForegroundColor Green

Write-Host "`n[+] Script complete. Review findings above and initiate incident response if compromises detected." -ForegroundColor Cyan