Threat Overview
Check Point Research published its technical analysis of Aokigahara on 23 October 2026. The Windows infostealer has been observed in the wild and collects browser sessions, password-manager and VPN data, SSH/Git/cloud credentials, and AI/developer-tool authentication material (Claude, Codex, ChatGPT Desktop, Cursor, Windsurf, GitHub Copilot and Gemini CLI). CPR identified encrypted X25519/AES-GCM upload traffic and three C2 endpoints: /gate/handshake, /gate/chunk and /gate/complete. Its collection capabilities are confirmed through malware analysis; monetization of stolen AI accounts remains researcher assessment, not an observed outcome. Initial-access vector, distribution mechanism and affected organizations were not established in the cited report.
References
Check Point Research, Infostealer riding the AI Train, 2026-10-23
Impacted Systems
Vendor/product: Aokigahara malware, not a product vulnerability. Platform: Windows endpoints and developer workstations; AI/developer clients, Chromium/Firefox, VPN and password managers, cloud CLIs, Git/SSH. Affected versions: Not version-bounded; any accessible credentials/files are targets. Prerequisite: Malware execution in the user context. Exposure: User endpoint execution, not an Internet-facing listening service. Fixed version: Not applicable. Unaffected: Non-executing hosts are not affected by this malware instance; non-Windows builds were not confirmed.
Why this matters
Stealing local AI, cloud, source-control and SSH secrets can bypass the protection of the applications that store them and enable follow-on cloud and developer-platform compromise.
Exploitation Status
Confirmed by Check Point Research (2026-10-23): malware observed in the wild; Windows data-theft capabilities, C2 protocol and IOCs. Not confirmed: initial infection chain, number of compromised organizations, successful enterprise cloud access or monetization. Researcher assessment: stolen tokens could be reused for unauthorized AI, code repository or cloud access.
What this hunt looks for
This package defines searches for Microsoft Sentinel endpoint (DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents), firewall/HTTP proxy (CommonSecurityLog where URL/header detail exists), and Windows SecurityEvent 4688 fallbacks. Defender endpoint tables are not interchangeable with generic CrowdStrike or Harmony alert ingestion. No customer logs were reviewed or queried during preparation; the sections below describe what would be reviewed where the relevant data source is ingested into Microsoft Sentinel.
Required logs
DeviceProcessEvents; DeviceNetworkEvents; CommonSecurityLog; DeviceFileEvents; SecurityEvent
Hunt 01 — Known Aokigahara Sample Hashes
Signal: High. Telemetry: DeviceProcessEvents. Exact SHA1 values from CPR; high-confidence but incomplete family coverage.
let IOCs=dynamic(["007137599bc4d69ee952a5228b5fcb2c3b9a95a7","00d52c7e759d878f0d8a117502f6d854af13f007","04eddccb79db41e03a4ee8542e8a33d7f1d9fe18","057a2d1dedeb93b7765c455a9e0c469e7cbe4843","079ddf5cc7d6ca2e02f860f87d4d18c83db9d331","0b74ce90a39278fb97fe94f6306af71cbe679503","0c46ac5555cf8f305c1345a21d0802c52bf52cd8","0d8d0bad2e08856ba379e425e2e90e49506af631","0e76150cee3f2b89f0fbe39106ab2898db109f09","0f69792cb926a416766d47a30a05009c13be0d64"]);
DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where SHA1 in~ (IOCs)
| project TimeGenerated,DeviceName,FileName,FolderPath,SHA1,ProcessCommandLine,InitiatingProcessFileName
| order by TimeGenerated descHunt 02 — Published C2 Destination Contacts
Signal: High. Telemetry: DeviceNetworkEvents. Network connections to CPR-published domains and IP, not generic AI service traffic.
let C2=dynamic(["dfwioeiofwr.info","dobeqnesmot.cc","gate.dfwioeiofwr.info","hjazfioe.surf","kkeyyou.cc","neihite.cc","somelitersofblood.pw"]);
DeviceNetworkEvents
| where TimeGenerated >= ago(14d)
| where RemoteIP == "2.26.252.48" or tolower(RemoteUrl) in (C2)
| project TimeGenerated,DeviceName,InitiatingProcessFileName,InitiatingProcessCommandLine,RemoteIP,RemotePort,RemoteUrl,ActionType
| order by TimeGenerated descHunt 03 — Firewall and Proxy Published C2 Matches
Signal: High. Telemetry: CommonSecurityLog. Match known C2s in normalized firewall/proxy destination and URL fields.
let C2=dynamic(["dfwioeiofwr.info","dobeqnesmot.cc","gate.dfwioeiofwr.info","hjazfioe.surf","kkeyyou.cc","neihite.cc","somelitersofblood.pw"]);
CommonSecurityLog
| where TimeGenerated >= ago(14d)
| extend Host=tolower(tostring(column_ifexists("DestinationHostName",""))),Url=tolower(tostring(column_ifexists("RequestURL","")))
| where DestinationIP == "2.26.252.48" or Host in (C2) or Url has_any (C2)
| project TimeGenerated,DeviceVendor,DeviceProduct,SourceIP,DestinationIP,Host,Url,DeviceAction,Message
| order by TimeGenerated descHunt 04 — Aokigahara HTTP Gate Sequence
Signal: High. Telemetry: CommonSecurityLog. Require multiple exact path endpoints from same source/destination within a short window.
CommonSecurityLog
| where TimeGenerated >= ago(14d)
| extend Url=tolower(tostring(column_ifexists("RequestURL","")))
| where Url contains "/gate/handshake" or Url contains "/gate/chunk" or Url contains "/gate/complete"
| extend Stage=case(Url contains "/gate/handshake","handshake",Url contains "/gate/chunk","chunk","complete")
| summarize Stages=make_set(Stage),Requests=count(),FirstSeen=min(TimeGenerated),LastSeen=max(TimeGenerated),URLs=make_set(Url,5) by SourceIP,DestinationIP,bin(TimeGenerated,30m)
| where set_has_element(Stages,"handshake") and set_has_element(Stages,"chunk")
| project FirstSeen,LastSeen,SourceIP,DestinationIP,Requests,Stages,URLs
| order by FirstSeen descHunt 05 — Distinctive HTTP Headers and Gate Path
Signal: High. Telemetry: CommonSecurityLog. Require C2 path plus CPR-observed X-KEX/X-Chunk/X-Gate-Token header names when logged.
CommonSecurityLog
| where TimeGenerated >= ago(14d)
| extend Url=tolower(tostring(column_ifexists("RequestURL",""))),Ext=tostring(column_ifexists("AdditionalExtensions","")),Msg=tostring(column_ifexists("Message",""))
| where Url contains "/gate/handshake" or Url contains "/gate/chunk"
| where Ext has_any ("X-KEX","X-Gate-Token","X-Chunk-Index","X-Build-ID") or Msg has_any ("X-KEX","X-Gate-Token","X-Chunk-Index","X-Build-ID")
| project TimeGenerated,SourceIP,DestinationIP,Url,DeviceVendor,DeviceProduct,DeviceAction,Ext,Msg
| order by TimeGenerated descHunt 06 — Clipper Staging Under Microsoft Vault
Signal: High. Telemetry: DeviceFileEvents. CPR-observed clipper deployment location, requiring executable file events beneath the folder.
DeviceFileEvents
| where TimeGenerated >= ago(14d)
| where FolderPath startswith @"C:\Microsoft\Vault\"
| where FileName endswith ".exe" or FileName endswith ".dll"
| project TimeGenerated,DeviceName,ActionType,FileName,FolderPath,SHA1,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by TimeGenerated descHunt 07 — Rare Process Egress to Public Destinations
Signal: Follow-up. Telemetry: DeviceNetworkEvents. Follow-up for unidentified stealer variants; filter unusual first-seen public destinations from non-standard execution locations.
let Known=DeviceNetworkEvents
| where TimeGenerated between (ago(30d)..ago(3d)) and RemoteIPType =~ "Public"
| summarize by DeviceId,RemoteIP;
DeviceNetworkEvents
| where TimeGenerated >= ago(3d) and RemoteIPType =~ "Public"
| where InitiatingProcessFolderPath has_any (@"\AppData\",@"\Temp\",@"\Downloads\",@"\Users\Public\")
| join kind=leftanti Known on DeviceId,RemoteIP
| project TimeGenerated,DeviceName,InitiatingProcessFileName,InitiatingProcessFolderPath,InitiatingProcessCommandLine,RemoteIP,RemotePort,RemoteUrl
| order by TimeGenerated descHunt 08 — Windows Process Creation from Clipper Location
Signal: High. Telemetry: SecurityEvent. Windows 4688 fallback for suspicious binaries launched from CPR-observed staging directory.
SecurityEvent
| where TimeGenerated >= ago(14d) and EventID == 4688
| where NewProcessName startswith @"C:\Microsoft\Vault\"
| project TimeGenerated,Computer,Account,NewProcessName,CommandLine,ParentProcessName
| order by TimeGenerated descDetection Notes
Highest signal: exact CPR SHA1 and known C2 destinations, plus correlated /gate/handshake→/gate/chunk traffic with characteristic headers. C2 domains/IPs may rotate; hash matches cover known samples only. /gate/chunk alone is not unique to malware; HTTP header visibility often requires a full proxy/WAF. DeviceFileEvents records file events, not arbitrary read access; no file-access conclusion can be drawn from absent file events. Clipper path is a secondary behavior, not proof of credential theft.
