Truth in IT
    • Sign In
    • Register
        • Videos
        • Channels
        • Pages
        • Galleries
        • News
        • Events
        • All
Truth in IT Truth in IT
  • Data Management ▼
    • Converged Infrastructure
    • DevOps
    • Networking
    • Storage
    • Virtualization
  • Cybersecurity ▼
    • Application Security
    • Backup & Recovery
    • Data Security
    • Identity & Access Management (IAM)
    • Zero Trust
    • Compliance & GRC
    • Endpoint Security
  • Cloud ▼
    • Hybrid Cloud
    • Private Cloud
    • Public Cloud
  • Webinar Library
  • TiPs
  • DRAW

Snyk: Removing Malware with GitHub Token Deadman Switch

Snyk
06/18/2026
0 (0%)
Share
  • Comments
  • Download
  • Transcript
Report Like Favorite
  • Share/Embed
  • Email
Link
Embed

Transcript


service that monitors whether your stolen github token has been revoked. On Linux it registers as a systemd user service. On macOS it registers as a launch agent. If it detects the token was revoked, it destroys your home directory. So you want to disable the monitor service first, then rotate credentials second, in that order. You can see how to disable the monitor service for your respective operating system on screen here, or you can check for more details in the blog shared in the description below. After the deadman switch is gone, remove the editor persistent hooks. The worm writes itself into two places, your Claude code project settings, and your VS code workspace tasks. Both are designed to re-execute the payload every time you open up either tool. Also, check for deaddrop commits authored under the fake identity the attacker used, which was a claude at no reply dot github dot com type of address. That email is the attacker impersonating the anthropic claude github app. Any commits from that identity in your repo are likely malicious. And with that, you have neutralized the persistence mechanism of this attack. You can safely move on to handling your credentials now.

TL;DR

  • Malware installs a deadman switch that destroys your home directory if it detects GitHub token revocation, making remediation order critical for data safety
  • First disable the monitor service (systemd on Linux, launch agent on macOS), then rotate credentials second to prevent triggering the destructive payload
  • Remove persistence mechanisms from Claude Code project settings and VS Code workspace tasks, and check for malicious commits from claude@noreply.github.com identity

Summary

This security advisory provides critical remediation steps for a sophisticated malware attack targeting developers through VS Code and Claude Code editors. The malware installs a deadman switch mechanism that monitors stolen GitHub tokens and destroys the user's home directory if token revocation is detected. The attack establishes persistence through systemd services on Linux, launch agents on macOS, and editor hooks in both Claude Code project settings and VS Code workspace tasks. Remediation must follow a specific sequence: first disable the monitoring service, then rotate credentials, remove editor hooks, and finally check for malicious commits authored under a fake Anthropic identity. The video emphasizes that following the correct order is essential to prevent data loss during the cleanup process.

Chapters

0:00 - Understanding the Deadman Switch
0:16 - Correct Remediation Order
0:30 - Removing Editor Persistence Hooks
0:43 - Identifying Malicious Commits

Key Quotes

0:00 "... remediation order is not optional. The malware installs a deadman switch, basically a background service that monitors whether your stolen GitHub token has been revoked."
0:16 "If it detects the token was revoked, it destroys your home directory. So you want to disable the monitor service first, then rotate credentials second, in that order."
0:48 "That email is the attacker impersonating the Anthropic claude GitHub app. Any commits from that identity in your repo are likely malicious."

FAQ

Why can't I just revoke my GitHub token immediately if it's been stolen?

The malware includes a deadman switch that monitors whether your token has been revoked. If it detects revocation before you disable the monitoring service, it will destroy your home directory. You must disable the monitor service first, then rotate credentials second.


Categories:
  • » Cybersecurity » Application Security
  • » Data Protection
Channels:
News:
Events:
Tags:
  • Application Security
  • DevSecOps
  • Threat Intelligence
  • How-To
  • malware remediation
  • GitHub token security
  • VS Code security
  • Claude Code security
  • deadman switch attacks
  • persistence mechanisms
  • developer security
  • credential rotation
Show more Show less

Browse videos

  • Related
  • Featured
  • By date
  • Most viewed
  • Top rated
  •  

              Video's comments: Snyk: Removing Malware with GitHub Token Deadman Switch

              XStreaminars (watch here)

              • Jul
                28

                Illumio + Netskope: Zero Trust in the Age of AI Autonomy

                07/28/202601:00 PM ET
                • Jul
                  29

                  Ask Your Cloud Anything: Unlocking Governance Silos in your Environments

                  07/29/202601:00 PM ET
                  More events

                  Industry Events (watch there)

                  • Jul
                    14

                    Crafting a Championship-Caliber Security Team for Lasting Defense

                    07/14/202601:00 PM ET
                    • Jul
                      14

                      Understanding the Crucial Role of Context in Safeguarding AI-Accessible Data

                      07/14/202602:00 PM ET
                      • Jul
                        22

                        Insights from Attackers During the FIFA World Cup: A HUMAN Dialogue

                        07/22/202601:00 PM ET
                        More events

                        Upcoming Webinar Calendar

                        • 07/14/2026
                          01:00 PM
                          07/14/2026
                          Crafting a Championship-Caliber Security Team for Lasting Defense
                          https://www.truthinit.com/index.php/channel/2025/crafting-a-championship-caliber-security-team-for-lasting-defense/
                        • 07/14/2026
                          02:00 PM
                          07/14/2026
                          Understanding the Crucial Role of Context in Safeguarding AI-Accessible Data
                          https://www.truthinit.com/index.php/channel/2037/understanding-the-crucial-role-of-context-in-safeguarding-ai-accessible-data/
                        • 07/21/2026
                          04:00 AM
                          07/21/2026
                          Strategies for Managing AI Governance and Securing App-to-LLM API Traffic
                          https://www.truthinit.com/index.php/channel/1967/strategies-for-managing-ai-governance-and-securing-app-to-llm-api-traffic/
                        • 07/22/2026
                          06:30 AM
                          07/22/2026
                          Insights and Strategies in Data Protection and Privacy Management
                          https://www.truthinit.com/index.php/channel/2000/insights-and-strategies-in-data-protection-and-privacy-management/
                        • 07/22/2026
                          01:00 PM
                          07/22/2026
                          Insights from Attackers During the FIFA World Cup: A HUMAN Dialogue
                          https://www.truthinit.com/index.php/channel/2029/insights-from-attackers-during-the-fifa-world-cup-a-human-dialogue/
                        • 07/28/2026
                          01:00 PM
                          07/28/2026
                          Illumio + Netskope: Zero Trust in the Age of AI Autonomy
                          https://www.truthinit.com/index.php/channel/2031/illumio-netskope-zero-trust-in-the-age-of-ai-autonomy/
                        • 07/29/2026
                          04:00 AM
                          07/29/2026
                          Real-Time Strategies for Safeguarding Against Prompt Injections
                          https://www.truthinit.com/index.php/channel/1968/real-time-strategies-for-safeguarding-against-prompt-injections/
                        • 07/29/2026
                          01:00 PM
                          07/29/2026
                          Ask Your Cloud Anything: Unlocking Governance Silos in your Environments
                          https://www.truthinit.com/index.php/channel/2048/ask-your-cloud-anything-unlocking-governance-silos-in-your-environments/
                        • 08/19/2026
                          12:00 PM
                          08/19/2026
                          Becoming Agent Ready: Insights from Cyera's Expertise
                          https://www.truthinit.com/index.php/channel/2036/becoming-agent-ready-insights-from-cyeras-expertise/
                        • 09/02/2026
                          12:00 PM
                          09/02/2026
                          Unified Data Security in Action: Uncover, Analyze, and Resolve Threats
                          https://www.truthinit.com/index.php/channel/2045/unified-data-security-in-action-uncover-analyze-and-resolve-threats/
                        • 09/30/2026
                          04:00 AM
                          09/30/2026
                          AI Command Center: Optimizing Visibility and Control in Your Operations
                          https://www.truthinit.com/index.php/channel/2024/ai-command-center-optimizing-visibility-and-control-in-your-operations/
                        Truth in IT
                        • Sponsor
                        • About Us
                        • Terms of Service
                        • Privacy Policy
                        • Contact Us
                        • Preference Management
                        Desktop version
                        Standard version