Malicious Claude Code Extension Compromises up to 5,000 Users

Security researchers have identified a compromised version of a Claude Code extension that potentially affected up to 5,000 users worldwide. The tampered extension was designed to integrate with the Claude code editor but was modified to exfiltrate sensitive information from compromised systems.

The extension attempted to gather multiple categories of user and host information without authorization. Data targeted included hostnames, usernames, operating system details and public IP addresses. Security experts warn that such information can be used for targeted attacks, social engineering or further compromise of affected systems.

Users who may have installed the extension from unofficial or compromised sources are advised to immediately remove it and review their system security. The incident underscores the risks associated with third-party browser extensions and the importance of downloading software only from official, verified sources.

Security firms recommend that affected users monitor their systems for suspicious activity and consider changing passwords for sensitive accounts as a precautionary measure. The developers of Claude have been notified of the compromise and are working to alert impacted users through official channels.