Click-Exfil turns one pasted command into Claude Code account takeover

Classic ClickFix leaves three usable artifacts, by the author's own account: the Run dialog writing to the RunMRU registry key, a PowerShell process parented by explorer.exe, and the fetch-and-execute pattern of iwr, irm or iex ^[9]. An upload-only command keeps two of them and removes the third ^[16]. The paste still lands in the Run dialog and the script host still has the wrong parent, but nothing is downloaded and no new binary runs. The command reads a file the user is entitled to read and posts it to a host the user is allowed to reach. The author is direct about where that leaves the stack: EDR is not designed to detect or block file uploads, and blocking specific file content going to an undesired site is a DLP job ^[11].

What leaves the machine is worth more than the command that sent it. On Windows and Linux, ~/.claude/.credentials.json holds Claude Code's OAuth access and refresh tokens in plaintext ^[3]. The access token buys inference on the victim's account, LLM-jacking in the author's phrasing, and the refresh token is the persistence layer, surviving a password reset ^[4]. A password reset, the first containment step most responders reach for, leaves that refresh token intact.

macOS moves the target rather than removing it. Keychain covers Claude Code credentials when authentication came through CLI login or the desktop app ^[6], so the fingerprinting page ^[5] points somewhere else instead: ~/.claude/projects/ retains session transcripts including prompts, file contents and command output ^[7]. Separately, MCP server credentials sit in plaintext env blocks across .claude.json and project-level .mcp.json ^[8], which are other vendors' secrets on a developer's disk. Across the writeup that is three named plaintext locations reachable by a single file read ^[15].

Scope, plainly stated: this is a red team proof of concept, with code and a demo page published, and the writeup reports no in-the-wild use ^[1][12][17]. There is no remote exploit against Claude Code here. It requires a human to paste a line, which is the same precondition ClickFix already satisfies routinely enough for the author to call it a fruitful source of initial access ^[14]. Two existing mitigations partially apply by accident: some organisations disabled the Run dialog outright, and macOS Tahoe warns when a pasted command looks suspicious ^[10].