Supply chain compromise distributes malicious Claude extensions to thousands of users

A sophisticated software supply chain attack has resulted in the dissemination of malicious browser extensions purporting to integrate Anthropic’s Claude AI across thousands of user devices. Independent cybersecurity researchers uncovered the malicious payloads, which were embedded within legitimate-appearing developer tools hosted on major browser web stores. The altered software allowed unauthorized actors to siphon browsing activity, capture credentials, and manipulate local application data.

The threat actors leveraged compromised developer accounts to publish authentic-looking updates to popular AI productivity utilities without triggering routine repository alerts. Once installed, the extensions secretly initiated connections with external command-and-control servers, enabling secondary payload execution across enterprise and consumer machines. Security teams have notified major platform operators, prompting the immediate takedown of the infected packages from extension stores.

Security specialists are advising affected users to audit their browser add-ons immediately, invalidate existing access tokens, and implement hardware multi-factor authentication across sensitive corporate environments. The breach underscores the vulnerability of modern browser ecosystems to supply chain attacks as malicious actors increasingly exploit the surging enterprise demand for artificial intelligence workflow tools.