[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqxxMfxOki5usib82aOuaISSIYp0tx2mM8YMeSma1tXM":3},{"article":4,"iocs":52,"watch_terms":53,"solutions":54,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":34,"category":35,"article_tags":39},"9013e68a-b0db-4e8c-a26c-e432cf6061f2","Claude Code Desktop Flaw Let Malicious HTML Steal Developer Credentials","claude-code-desktop-flaw-let-malicious-html-steal-developer-credentials-8279a0","Noma Labs found a high-severity Claude Code Desktop flaw that let malicious HTML files steal local credentials and…","A high-severity vulnerability, dubbed SneakPeek, was discovered in Anthropic's Claude Code Desktop application by Noma Labs. The flaw, with a CVSS score of 8.7, allowed malicious HTML files to steal local credentials and private keys, including SSH keys, AWS credentials, and GitHub tokens, by exploiting weaknesses in the preview pane's rendering engine. Anthropic has since released patches to address the vulnerability.","Claude Code Desktop flaw allowed malicious HTML to steal developer credentials and private keys.","https:\u002F\u002Fhackread.com\u002Fclaude-code-desktop-flaw-html-steal-credentials\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fclaude-code-desktop-flaw-html-steal-credentials.jpg","2026-10-16T17:35:05+00:00","2026-10-16T18:00:14.297257+00:00",8,[17,20,23,25,28,31],{"name":18,"type":19},"Claude Code Desktop","product",{"name":21,"type":22},"Anthropic","vendor",{"name":24,"type":19},"Electron",{"name":26,"type":27},"Chromium","technology",{"name":29,"type":30},"Noma Labs","threat_actor",{"name":32,"type":33},"SneakPeek","campaign","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":34,"icon":36,"name":37,"slug":38},null,"Vulnerabilities","vulnerabilities",[40,42,47],{"category":41},{"id":34,"icon":36,"name":37,"slug":38},{"category":43},{"id":44,"icon":36,"name":45,"slug":46},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":48},{"id":49,"icon":36,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18,24],{"controls":55,"vendors":140},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":86,"name":87,"problem":88,"products":89},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":115,"name":116,"problem":117,"products":118},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[119,126,134],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":115,"product_name":123,"url":124,"description":125},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":135,"product_name":136,"url":138,"description":139},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":158},"claude-code-desktop-flaw-enabled-html-based-credential-theft","Claude Code Desktop Flaw Enabled HTML-Based Credential Theft","The SneakPeek vulnerability in Anthropic's Claude Code Desktop exposed a critical weakness in how the application's preview pane rendered HTML content, allowing malicious files to access and exfiltrate sensitive local credentials such as SSH keys, AWS credentials, and GitHub tokens. This type of flaw — where a rendering engine fails to sandbox untrusted content — is particularly dangerous in developer tooling because developers routinely handle high-privilege credentials and secrets in their local environments. The high CVSS score of 8.7 reflects how easily an attacker could exploit this by tricking a developer into previewing a crafted HTML file. This matters because a single compromised developer machine can cascade into full cloud environment takeovers or source code repository breaches. Anthropic's patch mitigates the immediate risk, but the incident highlights the systemic danger of insufficient isolation in tools that process untrusted input.",[146,147,148,149,150,151,152,153,154,155,156,157],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","CIS Control 18: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-28: Protection of Information at Rest","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 IA-5: Authenticator Management","NIST CSF ID.AM-2: Software platforms and applications are inventoried","GDPR Article 32: Security of Processing (where EU developer data is involved)","OWASP ASVS V12: File and Resource Access Security","ITIL: Change Management — Emergency Patching Procedure",{}]