Symantec uncovers Aoki infostealer targeting AI service keys and crypto wallets
- —Aoki steals API keys from Claude, OpenAI Codex, Cursor, Codeium and Gemini
- —Data from MetaMask, Phantom, TronLink, Ledger Live, Tonkeeper and 70+ other wallets is at risk
- —The stealer searches for files named mnemonic, privatekey, seed, keystore, 12word, 24word
- —It also grabs Chrome and Firefox passwords, 1Password and Bitwarden vaults, and Telegram and Discord sessions
Why it matters: The attack combines AI key theft with crypto asset theft, so developers and wallet holders should audit devices and rotate credentials.
Source: Bits.media