Topic
Attack technique of collecting stolen credentials, keys and tokens from a compromised system and sending them to attacker-controlled servers.
Noma Security reported that Claude Code Desktop's preview ran scripts in HTML files over 256KB, a flaw Anthropic fixed in 1.30096.1. Those scripts could read SSH keys, AWS credentials and GitHub tokens, so previewed repo files should be handled as untrusted code.
Reality
Two CVEs describe a startup window where a repository's own config file set the CLI's base URL and hooks while the trust prompt was still pending. On Linux, the key that leaks shares a plaintext file with GitHub and AWS tokens.
Reality
Install hooks and .pth files execute before your first import, which puts the useful controls in resolver precedence and environment scope rather than in a test suite that passes either way.
Reality
KnowBe4 says a new build of the commodity infostealer uses Unicode emoji to break string signatures and keeps its final payload off disk. The lure is a spoofed bank thread aimed at finance teams.
Reality
Check Point found Claude Code project configs could execute commands and steal Anthropic API keys on clone. Anthropic has patched it. The trust model it exposed is still yours to manage.
Reality