Claude Code flaw lets malicious PRs hijack trusted repos

Claude Code vulnerability allows code execution via malicious pull requests

A security researcher has demonstrated a vulnerability in Anthropic’s Claude Code that allows a malicious pull request to trigger code execution and secret exfiltration when a developer opens the tool in a repository they have previously trusted. The issue was reported to Anthropic’s bug bounty program, which responded that the behavior is working as designed and falls outside the threat model of the workspace trust prompt. The vulnerability stems from project-scoped MCP server configuration, where a .mcp.json file at the root of a repository can define local MCP servers with arbitrary commands. When Claude Code starts a session, it automatically reads this file and runs any defined commands without prompting the user for confirmation, even before the user types anything and even pre-authentication. The trust model is the core issue: when a user first approves a folder, that grant extends to all content subsequently checked out into it, including other branches, so switching to a PR branch does not re-trigger the trust prompt. Anthropic compared this to VS Code’s own Workspace Trust model and stated that protecting against malicious changes to an already-trusted repository is outside the threat model. The exploit uses the command and args fields in .mcp.json as a direct process spawn with no sandbox, allow-list, or verification that the target is a real MCP server. Four attack variants were demonstrated, including a netcat reverse shell disguised as a Playwright MCP server, a payload staged via curl | sh, abuse of npx and docker commands, and a Windows-targeting PowerShell one-liner. A proof of concept was created against the Bootstrap repository, though the researcher noted any repository is vulnerable. The attack requires only cloning the repo, accepting the trust boundary once, checking out the branch, and opening Claude. The attacker receives a shell on the victim’s host, running with the developer’s own privileges. A production payload would first read ~/.claude, environment variables, SSH keys, and cloud credentials, exfiltrating them before establishing an interactive session. The proposed fix involves hashing all executable configuration files, including settings.json and .mcp.json, at the moment trust is granted, and revoking trust if anything changed. The researcher acknowledged this is not foolproof, as an attacker with local access could tamper with the hash store, but argued it would turn invisible code execution into a conscious choice. The practical takeaway is to treat .mcp.json, .claude/, and other agent-read config as executable code and review them before switching branches.

Claude Code RCE: How a Malicious PR Triggers Code Execution →

Midnight Blizzard sub-cluster targets travelers via captive portals in CaptiveCrunch campaign

Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread traffic manipulation attacks involving hospitality sector networks served by captive portals worldwide since early May 2026. The campaign, called CaptiveCrunch, involves manipulating DNS and HTTP traffic from networks served by captive portals to redirect user traffic through actor-controlled infrastructure. Microsoft has identified widespread compromise of Wi-Fi networks at hospitality-related organizations and other networks serviced by captive portal equipment in several countries, with ReliaQuest identifying the activity at hotels, conference centers, and other shared venues, assessing the goal is to access the accounts of corporate travelers. Storm-2945 has delivered malware purporting to be browser or operating system updates in response to automated connectivity checks. Multiple malware variants have been delivered, including CornFlake, a full-featured Windows RAT written in Go that serves as the primary persistent implant, and ChocoShell, a PowerShell-based infostealer delivered and executed entirely in-memory, targeting browser session cookies, saved passwords, Microsoft 365 SSO tokens, and Wi-Fi credentials. The campaign uses ClickFix techniques to elicit user execution of malware, and Microsoft is aware of indications the actor might target Android devices with similar techniques, as ClickFix landings include instructions to download and install an APK file. Since February 2026, Storm-2945 has conducted AI-augmented operations including targeted device code and OAuth code phishing campaigns leading to Entra device registration and data collection from Microsoft 365. Microsoft attributes the campaign to Storm-2945, an operational sub-cluster of Midnight Blizzard based on technical and operational overlaps, including similarities to Storm-2372, a Midnight Blizzard initial access operations sub-cluster known for device code and OAuth code phishing. Midnight Blizzard is a Russia-based threat actor attributed by the US and UK governments to the Foreign Intelligence Service of the Russian Federation (SVR), primarily targeting governments, diplomatic entities, NGOs, and IT service providers in the US and Europe. The campaign infrastructure includes FruitStone, a web-based C2 panel used to manage the campaign, implemented as a single-page application with all functionality exposed without authentication, branded as CloudSync Console with a footer reading Acuity Systems, Inc. — Cloud Infrastructure Portal v3.2.1. Since July 16, Microsoft has observed a portion of CaptiveCrunch landing pages redirecting users to device code authentication flow experiences, instructing users to enter a device code into a legitimate Microsoft sign-in page.

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft | Microsoft Security Blog →

Coinspect uncovers decade-old wallet-generation vulnerability amid active exploitation

Coinspect has been investigating a wallet-drain incident affecting users across multiple networks since May 2026, uncovering a wallet-generation vulnerability that had existed for more than a decade and was being actively exploited during the investigation. The investigation, named Ill Bloom, documented at illbloom.org, revealed that the underlying CryptoJS randomness vulnerability had existed for twelve years, had been fixed six years earlier, and had been publicly discussed multiple times in GitHub issues. CryptoJS has been effectively unmaintained since 2023, and some downstream wallet-related packages continued to rely on old, unmaintained code using insecure randomness for seed generation. Coinspect generated candidate recovery phrases using the vulnerable random number generation function, derived corresponding addresses, and compared them against blockchain data to identify addresses with transaction history. This process required significant computational resources and was performed progressively across multiple networks, derivation paths, and wallet configurations. The work confirmed several affected applications, including active wallets that released fixes and discontinued wallets without remediation. During the investigation, Coinspect reproduced the vulnerability, analyzed public blockchain activity, expanded the known vulnerable address sets, researched wallet implementations, and contacted emergency-response organizations. Coinspect created a public address checker on the Ill Bloom research site allowing users to verify whether their addresses matched the vulnerable address sets and providing guidance on next steps. The researchers considered the risks of publishing technical details, concluding that because exploitation had already been observed, withholding findings would not remove the threat. Disclosure helps affected projects and users identify vulnerable dependency paths, assess historical exposure, and migrate funds away from wallets generated with insecure randomness.

Ill Bloom: Investigating a Wallet Generation Vulnerability During Active Exploitation →

Canadian hacker pleads guilty in Snowflake breach affecting 165+ organizations

Connor Riley Moucka, a 26-year-old from Kitchener, Ontario, has pleaded guilty to orchestrating a data breach campaign against the cloud storage provider Snowflake Inc., compromising more than 165 victim organizations and stealing billions of sensitive customer records. The U.S. Department of Justice announced the plea. Victims included Ticketmaster, whose breach exposed 560 million user records; AT&T, whose call and text logs for more than 100 million customers were compromised; and Santander Bank, Advance Auto Parts, and Neiman Marcus. Moucka pleaded guilty to four counts: computer fraud, wire fraud, aggravated identity theft, and a related conspiracy charge. Court documents state that Moucka and co-conspirators used stolen login credentials to break into cloud-hosted data belonging to at least 165 customers of the SaaS company starting around February 2024. The stolen data included non-content call and text history records, banking information, payroll records, DEA registration numbers, driver’s license numbers, passport numbers, Social Security numbers, and other personally identifiable information, which was advertised for sale on BreachForums, Exploit.in, XSS.is, and Telegram. Prosecutors said the scheme brought in over $2.5 million in ransom payments, and Moucka separately obtained at least $495,000 by re-extorting a victim with threats to release more stolen data, in one instance using the stolen information of a government officer and that officer’s immediate family. Victim companies suffered more than $9.5 million in actual losses, and their customers numbered at least 100 million individuals. The breach did not stem from a flaw in Snowflake’s own infrastructure; a technical investigation by Google Cloud’s Mandiant unit in June 2024 found that hackers logged directly into customer accounts using credentials harvested years earlier by infostealer malware such as Lumma and Redline, on accounts lacking multi-factor authentication. Cybersecurity firm Huntress reported in November 2025 that Snowflake has since enforced multi-factor authentication by default and mandated stricter password complexity. Researchers tracked Moucka’s hacking group under the designation UNC5537, and law enforcement identified his primary online aliases as Judische and Waifu. Moucka was arrested at a home in Kitchener, Ontario in October 2024, and was transferred to U.S. federal custody in July 2025. He is scheduled to be sentenced on October 27, 2026. His aggravated identity theft conviction carries a mandatory minimum of two years in prison, while the remaining counts carry a maximum penalty of 30 years.

Canadian Hacker Admits to Snowflake Breach That Hit AT&T, Ticketmaster →

ENDLESSDOORS backdoor found in Chinese routers sold under multiple brand names

Cybersecurity company VulnCheck has found a deliberate backdoor in routers made by Shenzhen Zhibotong Electronics and sold under brand names including Zbtlink and Wiflyer. The backdoor, named ENDLESSDOORS, is a firmware implant that phones home to cloud servers in China to request instructions and can then be remotely controlled. It is a tool called rctl (remote control linux), uploaded to GitHub on January 14, 2015, and never updated; the server listens on port 7000 for client connections and can send individual shell commands or spawn a reverse bash shell. The researchers said it poses the biggest risk yet seen because the device initiates contact with its command and control servers, meaning the router does not need to be reachable from the internet — no listening port or inbound rule is required, and the outbound connection traverses NAT and typical egress filtering, making a device behind multiple firewalls as reachable as one with a public IP. Affected model numbers include CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526, and Z8102AX-2DSIM. VulnCheck advises users to ignore the router’s branding, check for these model numbers, and immediately disconnect and replace any affected device. Earlier this year, the US government banned the import and sale of all new models of Chinese routers, citing national security risks, following the discovery last year that thousands of Asus routers had been compromised by a botnet, with devices from Cisco, D-Link, and Linksys also targeted. A major challenge in avoiding such embedded malware is that many Chinese-made routers are sold under different brands, sometimes with different claimed countries of origin, and many are rebadged and supplied as standard by US ISPs, so customers do not know who made their router.

Biggest backdoor yet found in Chinese routers sold under multiple brand names →