Claude Code Account Swap Persistence
This rule flags shell commands that change which Anthropic account or API endpoint the Claude Code CLI is authenticating against. It matters because malicious npm/pip packages have used this trick to make a victim's machine unknowingly send its AI requests and billing to an attacker-controlled account.
How the attack works
An attacker gets code to run on a developer's machine, often via a compromised or malicious package install. That code edits Claude Code's identity artifacts /Ycheychain item, the credentials JSON file, the account block in ~/.claude.json, or environment variables like ANTHROPIC_AUTH_TOKEN and ANTHROPIC_BASE_URL, writing them into a shell profile, launchctl config, or Windows setx. The result is that future Claude Code sessions on that machine silently authenticate as a different account or talk to a different backend URL, while any remote-control or supply-chain artifact the attacker planted stays bound to their own account. This lets requests, usage, and cost be billed and logged against the victim instead of the attacker.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9f4c1e2a-6b70-4d38-8c51-2f6a83b7de14
- Severity
- Medium
Why it matters
A victim's Claude Code sessions can be silently redirected to bill, log, or route through an attacker-chosen account or endpoint, and the organization loses visibility into which credentials are actually authenticating its AI usage.
What you can do
- →Treat any unexpected change to ~/.claude/.credentials.json, ~/.claude.json's account fields, or the 'Claude Code-credentials' keychain/keyring entry as something to investigate, not just log.
- →Review shell profiles, launchctl plists, and Windows environment variables for ANTHROPIC_AUTH_TOKEN, ANTHROPIC_BASE_URL, or CLAUDE_CODE_OAUTH_TOKEN entries you did not set yourself.
- →Restrict which install scripts and postinstall hooks can write to dotfiles and environment configuration, and audit new dependencies before they run with full user privileges.
- →When this fires, manually confirm which account and base URL Claude Code is actually using, since the rule only flags the change and cannot prove which credential is now active.
Known benign look-alikes
- A developer migrating or backing up their own Claude Code profile between machines or accounts, e.g. `mv ~/.claude ~/.claude.bak` or copying ~/.claude/.credentials.json to a new host.
- Dotfile managers (chezmoi, stow, yadm) and provisioning tools (Ansible, Chef, Nix activation scripts) that copy or symlink ~/.claude/.credentials.json and ~/.claude.json.
- Enterprise onboarding or CI bootstrap scripts that persist ANTHROPIC_BASE_URL for an internal LLM gateway, or a service CLAUDE_CODE_OAUTH_TOKEN, into a shell profile or container image for headless runs.
- Clean re-authentication flows that run `security delete-generic-password -s "Claude Code-credentials"` (or the keyring equivalent) before a fresh login.
- Support/debug snippets that rewrite ~/.claude.json to clear a stale oauthAccount or organizationUuid after an organisation change or seat move.