Claude Code token-theft attacks

- Security researchers demonstrated attacks that steal OAuth tokens via malicious MCP integrations and npm hooks in Claude Code workflows. - Reports describe persistent token theft, fake Claude Code installers pushing PowerShell stealers, and malware spread through fake installers and ads. - The campaign highlights developer-targeted token theft vectors and urges cautious installation and scoped credentials. (esecurityplanet.com) (infosecurity-magazine.com)