A report on infostealer malware provides a basis for further investigation. However, the responders need evidence stored on the affected device.
Check Point Research published its report on Aokigahara on October 23, 2026. It described collection mechanisms for AI applications and developer tools, including Claude, Codex and Cursor. It explained configuration controls to module execution. Modules, regardless of their configuration, still maintained their code in the executable.
The report noted AI files might include session data, configurations, and credentials. Not all targeted files contain authentication secrets.
For responders, this means collection capabilities of targeted AI files do not necessarily lead to collection of evidence in a particular case.
Record sample and configuration #
The research report provides background. Record the sample associated with your case, along with configuration analysis, if any.
Ask your malware team which collection routines the configuration controls select. Document any uncertainty about execution.
The presence of a module in a binary provides capability to investigate. Still, the case must provide evidence of what happened on the endpoint.
Lunar’s Infostealer glossary provides background on this class of malware.
Review application files #
Figure out which applications of interest were found on the device. Include the user accounts, if any, in your record.
For each of interest, provide rationale and evidence for collection. Get help from the application’s owner to distinguish settings from authentication. Keep these findings in your restricted case file. A simple list of applications does not mean secrets were exposed.
Check for Subsequent Use #
If evidence indicates a credential has been exposed, figure out which service it is and who is running the service. Look for unusual activity with the service and apply the organization’s containment procedures. Collect evidence for subsequent use separately from collection evidence. State what supports the conclusion.
Distinguishing evidence for a malware sample from what the malware affected is important for the next analyst.
Add External Evidence #
Lunar’s token exposure monitoring uses information stealer data to determine exposure of secrets. Use context of the source file and the device may also aid in correlation to an investigation.
Consider other external evidence along with what’s internal. Leave unknowns when evidence is incomplete.
The investigation record should state what sample was reviewed, the relevant apps, what collection activity was observed and what was exposed. Assign an owner to the unanswered questions and keep supporting evidence.