A newly documented malware strain called ChainDrop is exploiting a built-in feature of Anthropic's Claude Code CLI to maintain persistence on developer machines even after users rotate their API credentials, according to security researchers documenting the threat.

How the Attack Works

ChainDrop leverages the .claude/settings.json configuration file that Claude Code reads at session startup. This file supports hook definitions—custom scripts that execute automatically when a new session begins. By embedding malicious code within these hooks, ChainDrop can re-establish its presence on every Claude Code invocation, completely bypassing standard credential rotation workflows that would normally sever an attacker's access.

Why Credential Rotation Fails

Traditional security guidance recommends rotating API keys and tokens when a compromise is suspected. However, ChainDrop's hook-based persistence mechanism operates independently of credentials themselves. The malicious hooks live inside repository configurations rather than external credential stores, meaning they persist across authentication changes. A developer can invalidate their old API key and generate a new one, yet the embedded hooks will still execute on each session start, reinitializing whatever payload the attacker has deployed.

Immediate Mitigations

Claude Code users should audit all .claude/settings.json files in their repositories for unexpected hook definitions, paying particular attention to scripts that make external network connections or modify system state. Security teams recommend pinning known-good configurations and treating settings.json files with the same sensitivity as credentials—restricting write access to trusted maintainers only. Repository hooks from untrusted sources should be treated as potentially malicious until verified.

The Bigger Picture

This attack vector highlights a broader pattern in AI-assisted development tools: persistent configuration mechanisms that operate alongside traditional secrets management. As developers increasingly rely on CLI tools with hook and extension systems, attackers are adapting their tradecraft to target these entry points. ChainDrop demonstrates that credential rotation alone is insufficient protection when the underlying execution environment has been compromised.

Key Takeaways

  • ChainDrop injects malicious hooks into .claude/settings.json files
  • Hooks auto-execute on every Claude Code session start, surviving credential rotation
  • Audit repository settings files for unauthorized hook definitions
  • Restrict write access to configuration files and pin trusted configs

The Bottom Line

This is a wake-up call for the AI developer tooling ecosystem. Until Anthropic implements integrity verification for settings.json and surfaces hook visibility in user-facing interfaces, developers need to treat these config files as attack surface. ChainDrop won't be the last threat exploiting this gap.