# Claude Code Account Swap Persistence

- **Severity:** Medium
- **Signature ID:** `9f4c1e2a-6b70-4d38-8c51-2f6a83b7de14`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise), AML.T0012 (Valid Accounts), AML.T0050 (Command and Scripting Interpreter)
- **OWASP:** LLM03 (Supply Chain)

## Summary

This rule flags shell commands that change which Anthropic account or API endpoint the Claude Code CLI is authenticating against. It matters because malicious npm/pip packages have used this trick to make a victim's machine unknowingly send its AI requests and billing to an attacker-controlled account.

## How the attack works

An attacker gets code to run on a developer's machine, often via a compromised or malicious package install. That code edits Claude Code's identity artifacts /Ycheychain item, the credentials JSON file, the account block in ~/.claude.json, or environment variables like ANTHROPIC_AUTH_TOKEN and ANTHROPIC_BASE_URL, writing them into a shell profile, launchctl config, or Windows setx. The result is that future Claude Code sessions on that machine silently authenticate as a different account or talk to a different backend URL, while any remote-control or supply-chain artifact the attacker planted stays bound to their own account. This lets requests, usage, and cost be billed and logged against the victim instead of the attacker.

## Why it matters

A victim's Claude Code sessions can be silently redirected to bill, log, or route through an attacker-chosen account or endpoint, and the organization loses visibility into which credentials are actually authenticating its AI usage.

## What you can do

- Treat any unexpected change to ~/.claude/.credentials.json, ~/.claude.json's account fields, or the 'Claude Code-credentials' keychain/keyring entry as something to investigate, not just log.
- Review shell profiles, launchctl plists, and Windows environment variables for ANTHROPIC_AUTH_TOKEN, ANTHROPIC_BASE_URL, or CLAUDE_CODE_OAUTH_TOKEN entries you did not set yourself.
- Restrict which install scripts and postinstall hooks can write to dotfiles and environment configuration, and audit new dependencies before they run with full user privileges.
- When this fires, manually confirm which account and base URL Claude Code is actually using, since the rule only flags the change and cannot prove which credential is now active.

## Known benign look-alikes

- A developer migrating or backing up their own Claude Code profile between machines or accounts, e.g. `mv ~/.claude ~/.claude.bak` or copying ~/.claude/.credentials.json to a new host.
- Dotfile managers (chezmoi, stow, yadm) and provisioning tools (Ansible, Chef, Nix activation scripts) that copy or symlink ~/.claude/.credentials.json and ~/.claude.json.
- Enterprise onboarding or CI bootstrap scripts that persist ANTHROPIC_BASE_URL for an internal LLM gateway, or a service CLAUDE_CODE_OAUTH_TOKEN, into a shell profile or container image for headless runs.
- Clean re-authentication flows that run `security delete-generic-password -s "Claude Code-credentials"` (or the keyring equivalent) before a fresh login.
- Support/debug snippets that rewrite ~/.claude.json to clear a stale oauthAccount or organizationUuid after an organisation change or seat move.

## References

- https://attack.mitre.org/techniques/T1078/
- https://attack.mitre.org/techniques/T1552/001/
- https://attack.mitre.org/techniques/T1195/002/
- https://atlas.mitre.org/techniques/AML.T0010
- https://atlas.mitre.org/techniques/AML.T0012

---
Source: https://www.netzilo.com/threats/claude-account-swap-persistence