Snyk: Removing Malware with GitHub Token Deadman Switch

Name: Snyk: Removing Malware with GitHub Token Deadman Switch
Uploaded: 2026-06-18T17:42:21-04:00
Duration: 1 min 9 s
Description: TL;DR Malware installs a deadman switch that destroys your home directory if it detects GitHub token revocation, making remediation order critical for data safety First disable the monitor service (systemd on Linux, launch agent on macOS), then rotate ...

Snyk

06/18/2026

0 (0%)

Report Like Favorite

TL;DR

Malware installs a deadman switch that destroys your home directory if it detects GitHub token revocation, making remediation order critical for data safety
First disable the monitor service (systemd on Linux, launch agent on macOS), then rotate credentials second to prevent triggering the destructive payload
Remove persistence mechanisms from Claude Code project settings and VS Code workspace tasks, and check for malicious commits from claude@noreply.github.com identity

Summary

This security advisory provides critical remediation steps for a sophisticated malware attack targeting developers through VS Code and Claude Code editors. The malware installs a deadman switch mechanism that monitors stolen GitHub tokens and destroys the user's home directory if token revocation is detected. The attack establishes persistence through systemd services on Linux, launch agents on macOS, and editor hooks in both Claude Code project settings and VS Code workspace tasks. Remediation must follow a specific sequence: first disable the monitoring service, then rotate credentials, remove editor hooks, and finally check for malicious commits authored under a fake Anthropic identity. The video emphasizes that following the correct order is essential to prevent data loss during the cleanup process.

Chapters

0:00 - Understanding the Deadman Switch
0:16 - Correct Remediation Order
0:30 - Removing Editor Persistence Hooks
0:43 - Identifying Malicious Commits

Key Quotes

0:00 "... remediation order is not optional. The malware installs a deadman switch, basically a background service that monitors whether your stolen GitHub token has been revoked."
0:16 "If it detects the token was revoked, it destroys your home directory. So you want to disable the monitor service first, then rotate credentials second, in that order."
0:48 "That email is the attacker impersonating the Anthropic claude GitHub app. Any commits from that identity in your repo are likely malicious."

FAQ

Why can't I just revoke my GitHub token immediately if it's been stolen?

The malware includes a deadman switch that monitors whether your token has been revoked. If it detects revocation before you disable the monitoring service, it will destroy your home directory. You must disable the monitor service first, then rotate credentials second.

Categories:

» Cybersecurity » Application Security
» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Bridging the SaaS Protection Gap: Preventing Data Loss and AI Missteps

The Automation Escalation: Discovering the AI-Driven Underground Revolution

Invisible Data: Understanding What You Can't Safeguard