A sophisticated malware campaign is actively targeting software developers and security professionals by exploiting trust in Anthropic's Claude tooling. The operation, documented by threat researchers at 7AI, represents a broader shift in which AI developer tools have become a primary attack surface, not just a development accelerant.

The Campaign

The campaign, which 7AI has designated Claude Fraud, runs through two confirmed vectors. The first uses Google-sponsored search ads to surface counterfeit landing pages that deliver the MacSync infostealer to macOS users via a ClickFix terminal command. The second delivers a trojanized VS Code extension that executes PowerShell silently on Windows, masquerading as a legitimate Claude Code plugin.

More than 15,600 victims have been publicly documented. 7AI confirmed three incidents in monitored enterprise environments. The operation has proven resilient: when the original fake download page was taken down, operators deployed a Squarespace-hosted replacement within the same ad campaign. Key command-and-control infrastructure includes a2abotnet[.]com on macOS and claude-code.official-version[.]com on Windows.

The campaign targets developers and security practitioners precisely because they trust AI tooling. That familiarity lowers the guard that would otherwise catch a suspicious download or extension.

A Deeper Vulnerability Pattern

Claude Fraud is the most operationally active expression of a broader problem. Researchers at Check Point have documented a "Claude Code Jailbreak" circulating in criminal forums that exploits the same configuration files legitimate developers use to define project context. By modifying CLAUDE.md and associated skill files, attackers can override safety controls and reassign the agent's operational role. The agent then generates malware, including remote access trojans, because its own hierarchy tells it to.

This is architecturally distinct from prompt injection. Traditional single-prompt jailbreaks are declining as platforms improve detection. Modifying the agent's foundational context files is the technique that has replaced them.

Separately, researchers disclosed three chained vulnerabilities in Claude.ai itself that enable silent data exfiltration without any third-party integrations. The chain uses invisible prompt injection via URL parameters, exfiltration through the Anthropic Files API (permitted by the code execution sandbox), and an open redirect on claude.com weaponizable through paid search. Anthropic has patched the prompt injection flaw.

The Context

These findings arrive against a backdrop of escalating AI-related threat activity. In September 2025, Anthropic disclosed that a Chinese state-sponsored group had weaponized Claude Code to infiltrate approximately 30 organizations across financial services, government, and chemical manufacturing. That was the first documented AI-orchestrated cyberattack at scale.

Check Point's concurrent research into VoidLink, a cloud-native Linux malware framework built by a single developer in under a week using AI-assisted tooling, illustrates the supply-side shift: AI development environments have collapsed the time and team-size requirements for producing sophisticated offensive tools. The framework's development methodology was discovered only because of an unrelated operational security failure. In most cases, AI involvement leaves no trace.

Claude's ubiquity in developer environments is precisely what makes it the most productive vector to exploit and the most important surface to secure.

Sources: 7AI Threat Research, Check Point Research, CybersecurityNews

–

By the Control Plane Editorial Team