Aoki infostealer, fake installers and GhostAction target AI coding tool credentials

Oct 12, 2026 · Issue 11 · 5 sources, 5 articles

The Aoki infostealer targets the credentials of AI coding assistants, and Google ads are spreading fake Claude Code installer pages to Mac users. According to Socket, a new wave of GhostAction is targeting AI keys on GitHub.

Who is affected and how

junior developer

Download installers only from the official documentation, never by clicking an ad.

Narrative: The coding agent is the new attack surface

Sources

• New Aoki Infostealer Targets AI Coding Assistant Credentialsinfosecurity magazine · Oct 15, 2026
• New Aoki Infostealer Targets AI Coding Assistant Credentials - Infosecurity Magazineinfosecurity-magazine.com · Oct 15, 2026
• New infostealer targets AI coding assistant credentials - SC Mediascworld.com · Oct 16, 2026
• Google Ads Lead Mac Users to Fake Claude Code Installation Pagesesecurity planet · Oct 12, 2026
• New GhostAction wave on GitHub targets AI keys, Socket says | HellasFuture Newshellasfuture.com · Oct 12, 2026

Machine-generated summary based on the titles and excerpts of the source articles. The facts come from the linked article.