---
title: Hunt: Aoki stealer on developer endpoints (non-IDE processes reading .claude.json, Codex .env, Cursor state DB; POSTs to /gate) | ctxsec
url: https://ctxsec.com/items/hunt-aoki-ai-token-files
description: ""
status: "hunt idea (vendor IOCs)"
published: 2026-10-18
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-aoki-ai-token-files.md)

hunt idea (vendor IOCs)

2026-10-18

### Hunt: Aoki stealer on developer endpoints (non-IDE processes reading .claude.json, Codex .env, Cursor state DB; POSTs to /gate)

(1) DNS or proxy hits for dobeqnesmot[.]cc, hjazfioe[.]surf, neihite[.]cc, or any HTTPS POST to a path ending /gate from a user workstation; older samples used plain HTTP to an IP on port 8080. (2) File-read telemetry where a process other than the AI tool, its IDE or backup reads the user's .claude.json, Codex config.toml or .env files, or Cursor's local state database, especially in a burst alongside browser cookie and wallet paths. (3) Symantec's SHA-256 list (17 hashes) in EDR. On a hit, isolate the host, then revoke AI-tool sessions and OAuth grants and rotate repo PATs, SSH keys, cloud keys and anything in .env files from a clean device.

Sources: [Symantec Threat Hunter Team (IOCs)](https://www.security.com/threat-intelligence/aoki-infostealer-ai-targeting)