Claude Code MCP Traffic Hijack via Malicious npm postinstall — ~/.claude.json Tampering Proxies MCP Endpoints to Steal Persistent OAuth Bearer Tokens (Mitiga Labs PoC)

Key facts for Claude Code MCP hijack

Detection coverage for Claude Code MCP hijack

As of 2026-06-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0712 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Claude Code SessionStart Hook Injection & Trust-Flag Seeding — Post-Exploitation Phase

Detects persistence seeding in the MCP Traffic Hijack: injection of a SessionStart lifecycle hook and pre-seeding of hasTrustDialogAccepted=true into ~/.claude.json. The SessionStart hook gives recurring code execution on every Claude Code load and reseeds malicious config; trust-flag seeding suppresses the directory-trust prompt without user consent.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1546, T1556, T1548
• Data sources: sysmon, edr, file_integrity_monitoring
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*\\.claude.json" 
| append [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CommandLine="*hasTrustDialogAccepted*" OR CommandLine="*SessionStart*") CommandLine="*.claude.json*" ] 
| eval indicator=case(match(CommandLine,"(?i)hasTrustDialogAccepted"),"trust_flag_seed", match(CommandLine,"(?i)SessionStart"),"sessionstart_hook_inject", true(),"config_write") 
| stats count values(indicator) as indicators values(CommandLine) as cmd values(Image) as proc by Computer, User 
| where count > 0

Microsoft KQL

union DeviceProcessEvents, DeviceFileEvents | where Timestamp > ago(24h) | where (ProcessCommandLine has_any ('hasTrustDialogAccepted','SessionStart') and ProcessCommandLine has '.claude.json') or (FileName =~ '.claude.json' and InitiatingProcessCommandLine has_any ('SessionStart','hasTrustDialogAccepted')) | extend Indicator = case(ProcessCommandLine has 'hasTrustDialogAccepted','trust_flag_seed', ProcessCommandLine has 'SessionStart','sessionstart_hook_inject','config_write') | project Timestamp, DeviceName, AccountName, Indicator, InitiatingProcessFileName, ProcessCommandLine, InitiatingProcessCommandLine, FolderPath

Sigma

title: Claude Code SessionStart Hook Injection and Trust Flag Seeding
id: 9a2b7e54-3c1d-4f88-b6a0-7d5e1c2f3a90
status: experimental
description: Detects injection of a SessionStart hook or seeding of hasTrustDialogAccepted into ~/.claude.json, the persistence/reseeding mechanism of the Claude Code MCP Traffic Hijack.
references:
    - https://www.mitiga.io/blog/claude-code-mcp-token-theft-mitm
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/08
tags:
    - attack.persistence
    - attack.t1546
    - attack.defense_evasion
    - attack.t1556
    - attack.t1548
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'hasTrustDialogAccepted'
            - 'SessionStart'
        cfg:
            CommandLine|contains: '.claude.json'
    condition: selection and cfg
falsepositives:
    - Administrators legitimately configuring Claude Code hooks or trust state
level: high

Known false positives:

• Legitimate admin configuration of Claude Code SessionStart hooks
• User explicitly accepting directory trust through supported tooling

Tuning notes: Parse ~/.claude.json with FIM and diff the hooks and projects keys; alert on any new SessionStart entry or trust flag for a path not in an approved allowlist. Whitelist known IT-managed config-push processes.

• 🔒 MDE: npm postinstall Writing Claude Code Config — Exploitation Phase · unlock with TL Creds
• 🔒 MDE: SessionStart Hook & Trust-Flag Persistence in Claude Code Config — Post-Exploitation Phase · unlock with TL Creds
• 🔒 MDE: MCP OAuth Bearer Redirection via Loopback Proxy — C2/AiTM Phase · unlock with TL Creds
• 🔒 Sigma: Claude Code Config Tamper During Package Install — Exploitation Phase · unlock with TL Creds
• 🔒 Sigma: SessionStart Hook Injection & Trust-Flag Seeding — Post-Exploitation Phase · unlock with TL Creds
• 🔒 Sigma: mcpServers Loopback Rewrite & OAuth Bearer Interception — C2/AiTM Phase · unlock with TL Creds
• 🔒 Claude Code Config Tampering by npm postinstall — Exploitation Phase · unlock with TL Creds
• 🔒 Claude Code mcpServers Rewrite to Loopback Proxy & OAuth Bearer Capture — C2/AiTM Phase · unlock with TL Creds

Indicators of compromise for Claude Code MCP hijack

As of 2026-06-08, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-0712.

How Claude Code MCP hijack works

Because the config is reseeded on every Claude Code load, token rotation alone does not remediate. Anthropic ruled it out of scope (prior user consent); no patch planned.

Mitiga Labs published a proof-of-concept attack chain that abuses Anthropic Claude Code's trust and Model Context Protocol (MCP) configuration model to silently exfiltrate OAuth bearer tokens for SaaS services connected over MCP. The entire attack lives in a single user-level file that few teams monitor: the global ~/.claude.json, which stores directory trust state, lifecycle hooks, MCP server endpoint definitions, and — critically — OAuth access and refresh tokens in plaintext.

Delivery (Step 1): The attacker publishes or compromises an npm package containing a silent postinstall lifecycle script. When a developer runs `npm install`, the postinstall hook executes with the developer's privileges and edits ~/.claude.json. It pre-populates directory-trust acceptance flags (the trust-dialog state, e.g. hasTrustDialogAccepted) set to true across common developer clone paths, so that when Claude Code later opens those projects no trust prompt fires and no user consent is solicited.

Persistence seeding (Step 2): The same hook inserts a SessionStart hook into ~/.claude.json. SessionStart hooks run automatically every time Claude Code loads a trusted project, giving the attacker recurring code execution that survives normal cleanup.

MCP endpoint rewrite (Step 3): On each load, the SessionStart hook rewrites the URLs in the mcpServers section of the config, replacing the legitimate remote MCP server endpoints (for example the Atlassian or GitHub MCP servers) with addresses pointing to an attacker-controlled localhost proxy. In the PoC the proxy is implemented with mitmproxy.

Token interception (Step 4): When Claude Code next initializes a session it connects to the rewritten endpoint. The MCP OAuth flow — including the bearer token carried in the HTTP Authorization header and any token refresh using the stored refresh token — transits the attacker's local proxy, which captures the token in clear text. Because Claude Code's MCP traffic to remote providers egresses through Anthropic's infrastructure, the provider sees an apparently valid OAuth flow from a trusted origin (Anthropic egress IP range), so the theft is essentially unattributable server-side.

Persistent reseeding (Step 5): The SessionStart hook reasserts the malicious configuration on every load. If a defender manually corrects an MCP URL or rotates the stolen credential, the next session reseeds the proxy URL and the next OAuth refresh re-captures a fresh token. The four properties that make the stolen tokens valuable: persistent (stored for reuse with an associated refresh token), broadly scoped (inheriting every permission granted at authorization time), weakly stored (plaintext in ~/.claude.json), and server-side unattributable (presented from Anthropic egress IPs).

Remediation order is the key defensive insight: rotating tokens first is ineffective because the live hook recaptures the refreshed token. Defenders must remove the SessionStart hook, clean malicious trust flags and mcpServers entries from ~/.claude.json, and only then rotate the affected SaaS OAuth credentials.

Disclosure: Mitiga reported to Anthropic on 2026-04-10; Anthropic acknowledged on 2026-04-11 and on 2026-04-12 classified it out of scope, citing the requirement of prior user consent (installing the npm package and trusting the directory). No patch is planned, so the technique remains viable and detection/IR ownership falls to defenders.

MITRE ATT&CK techniques by tactic:

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1204.003 Malicious Image

Command and Control

T1090.001 Proxy: Internal Proxy

initial-access

T1195 Supply Chain Compromise

Initial Access

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools

Credential Access

T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1557 Adversary-in-the-Middle

Persistence

T1546 Event Triggered Execution; T1547 Boot or Logon Autostart Execution

privilege-escalation

T1548 Abuse Elevation Control Mechanism

defense-impairment

T1556 Modify Authentication Process; T1685 Disable or Modify Tools

Resource Development

T1583 Acquire Infrastructure

Remediation for Claude Code MCP hijack

Patches

• No vendor patch available — Anthropic classified the report out of scope on 2026-04-12 and stated no patch is planned

Immediate actions

• Remove any attacker-injected SessionStart hook from ~/.claude.json BEFORE rotating any credentials
• Inspect and clean the mcpServers section of ~/.claude.json — restore legitimate remote MCP endpoint URLs and remove any localhost/proxy URLs
• Audit directory trust flags (e.g. hasTrustDialogAccepted) in ~/.claude.json and revoke trust for paths the user did not explicitly approve
• Only AFTER the hook and config are cleaned, rotate/revoke OAuth tokens and refresh tokens for all MCP-connected SaaS (Atlassian/Jira/Confluence, GitHub)

Workarounds

• Disable npm lifecycle scripts (npm config set ignore-scripts true) for untrusted installs
• Pin and review MCP server URLs; alert on any change to mcpServers entries or new local proxy listeners
• Store MCP OAuth credentials in an OS keychain rather than relying on Claude Code plaintext storage where supported

Longer-term hardening

• Treat ~/.claude.json as a sensitive secret store; restrict permissions and monitor it with file integrity monitoring (FIM)
• Run npm install with --ignore-scripts in CI and on developer machines where feasible to neutralize postinstall hooks
• Vet npm dependencies and lockfiles; use allowlists and scoped registries for AI-tooling dependencies
• Prefer short-lived, narrowly-scoped OAuth grants for MCP connections; avoid broad scopes and long-lived refresh tokens where the provider allows
• Educate developers that directory trust prompts and MCP endpoint URLs are security boundaries

Affected and fixed versions

• Anthropic — Claude Code
  Vulnerable versions: all versions storing OAuth tokens in plaintext ~/.claude.json with user-writable trust flags and SessionStart hooks
  Fixed in: none — out of scope, no patch planned
• Atlassian — Jira / Confluence (MCP OAuth connection)
  Vulnerable versions: MCP-connected via Claude Code OAuth
• GitHub — GitHub (MCP OAuth connection)
  Vulnerable versions: MCP-connected via Claude Code OAuth

Timeline of Claude Code MCP hijack

• 2026-04-10 Mitiga Labs reported the MCP traffic hijack / OAuth token theft technique to Anthropic.
• 2026-04-11 Anthropic acknowledged receipt of the Mitiga report.
• 2026-04-12 Anthropic classified the report out of scope, citing prior user consent (package install + directory trust); stated no patch is planned.
• 2026-06-08 Threadlinqs Intelligence ingested the threat as TL-2026-0712 (SUPPLY_CHAIN, HIGH) and initiated detection and simulation development.
• 2026-06-08 Mitiga Labs publicly disclosed the five-step attack chain with a proof-of-concept using locked-ioc-12; covered by Cyber Security News, SecurityWeek, eSecurity Planet, and CSO Online.

Sources cited for Claude Code MCP hijack

• Claude Code MCP Token Theft: MitM Attack Explained mitiga.io · Research · 2026-06-08
• Mitiga Labs: MCP Hijack Attack Steals Claude Code OAuth Tokens via Silent Man-in-the-Middle gridthegrey.com · Blog · 2026-06-08
• Hackers Can Hijack Claude Code MCP Traffic to Steal OAuth Tokens cybersecuritynews.com · News · 2026-06-08
• Claude Code OAuth Tokens Can Be Stolen Through Stealthy MCP Hijacking SecurityWeek · News · 2026-06-08
• Claude Code MCP Attack Enables Persistent Token Theft esecurityplanet.com · News · 2026-06-08
• Claude Code has an MCP security problem — and your developers are already using it csoonline.com · News · 2026-06-08

Threats related to Claude Code MCP hijack

• jscrambler npm Package Supply Chain Compromise (v8.14.0 Malicious Release)
• lightning PyPI Package Compromise — Versions 2.6.2 & 2.6.3 Execute Bun-Based JavaScript Credential Stealer on Import (Shai-Hulud-Overlapping)

Previous and next in supply chain

• Shai-Hulud "Hades" Miasma Worm — New PyPI Wave: 37 Malicious Wheels Across 19 Packages Abuse *-setup.pth Startup Hook to Launch Bun-Powered Credential Stealer Previous report
• Miasma Worm Compromises 73 Microsoft GitHub Repositories Across Azure, Azure-Samples, Microsoft & MicrosoftDocs — Self-Replicating Mini Shai-Hulud Variant Weaponizing AI Coding Agents (TeamPCP) Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages