Threat researchers have uncovered a novel man-in-the-middle (MitM) attack chain targeting Anthropic’s Claude Code ecosystem, where adversaries hijack Model Context Protocol (MCP) traffic to steal OAuth authentication tokens and persist access to enterprise SaaS platforms.
The technique, detailed by Mitiga, abuses weak protections around the local Claude Code configuration file (~/.claude.json), effectively turning it into a control plane for redirecting authenticated API traffic.
Unlike traditional credential theft, the attack leverages legitimate OAuth flows and trusted infrastructure, making malicious activity indistinguishable from normal user behavior in provider-side logs, such as those in Atlassian Jira or Confluence audit trails.
At the core of the attack is the MCP OAuth token, a high-value artifact that grants persistent, scoped access to connected services. Once a user authorizes an MCP integration, Claude Code stores bearer and refresh tokens in plaintext within ~/.claude.json.
These tokens are long-lived, automatically refreshed, and reused across sessions without re-consent. Critically, MCP requests are routed through Anthropic-controlled egress infrastructure, meaning that even traffic relayed by attackers appears to originate from a trusted source.
This combination of persistent tokens, broad scopes, weak local storage, and trusted network origin creates an ideal scenario for stealthy token exfiltration and reuse.
The attack chain begins with a supply-chain vector, typically a malicious npm package that embeds a post-install hook. Upon execution, the hook modifies local Claude Code settings, preseeds trusted project paths, and silently edits MCP server configurations.
By setting trust flags in advance, the attacker bypasses user prompts and ensures that future project loads automatically execute embedded hooks. The next stage involves rewriting MCP endpoints in ~/.claude.json to point to an attacker-controlled proxy, such as a local mitmproxy instance.
When Claude Code initiates or refreshes an MCP session, OAuth tokens are transmitted through this proxy, allowing interception of Authorization headers in transit.
Persistence is achieved through continuous reseeding. The malicious hook executes on every Claude Code session start, restoring rogue MCP configurations even if the user attempts remediation.
Token rotation, typically an effective response to compromise, fails in this scenario, as refreshed tokens are re-captured via the same proxy mechanism.
This transforms a one-time compromise into a durable access channel, enabling attackers to maintain control over SaaS integrations indefinitely without triggering endpoint or network-based alerts.
From a detection standpoint, traditional indicators offer limited visibility. Provider logs show valid sessions, legitimate user identities, and trusted IP ranges associated with Anthropic infrastructure. Endpoint telemetry may also appear benign, with the only anomaly being subtle modifications to ~/.claude.json.
Defenders are advised to baseline approved MCP server endpoints, monitor configuration file integrity, and alert on unauthorized changes or the introduction of local proxy URLs. Additional telemetry should focus on anomalous OAuth refresh patterns and unusual downstream activity, such as unexpected Jira queries or data access behaviors inconsistent with user roles.
Example indicators of compromise (IOCs) include unauthorized edits to ~/.claude.json, the presence of localhost or non-standard MCP endpoints, suspicious npm packages with postinstall scripts, and repeated OAuth token refreshes originating from modified configurations. File integrity monitoring and developer environment hardening are critical to mitigating such risks.
The disclosure timeline indicates initial discovery on March 23, 2026, with reporting to Anthropic on April 10. The vendor classified the issue as out of scope, citing the prerequisite of user-level code execution.
However, the broader security implications remain significant. By chaining supply chain manipulation with the abuse of AI tool configuration, attackers can turn developer environments into persistent credential exfiltration points.
As AI-assisted development tools become more integrated with enterprise systems, this research highlights a growing attack surface where trust boundaries are implicitly extended but insufficiently monitored.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…