Hackers Can Weaponize Claude Skills to Execute MedusaLocker Ransomware Attack
Anthropic's Claude AI has introduced a feature called Claude Skills, which has been identified as a potential vector for ransomware attacks. This feature, which enhances the AI's capabilities through custom code modules, can be manipulated to deploy…
Anthropic's Claude AI has introduced a feature called Claude Skills, which has been identified as a potential vector for ransomware attacks. This feature, which enhances the AI's capabilities through custom code modules, can be manipulated to deploy malware, such as the MedusaLocker ransomware, without explicit user awareness.
The design of Claude Skills, based on a single-consent trust model, poses significant security risks. Once a user grants initial permission to a Skill, it can perform various background actions, including downloading and executing additional malicious code.
Security analysts from Cato Networks have highlighted this as a notable security gap. A seemingly harmless Skill shared through public repositories or social media can serve as a Trojan horse for ransomware attacks, potentially affecting many users due to Anthropic's extensive customer base.
The impact of such an attack can be significant. A single employee installing a malicious Claude Skill could inadvertently trigger a company-wide ransomware incident, leveraging the trust users place in the AI's functionality.
Anthropic's Claude AI has introduced a feature called Claude Skills, which has been identified as a potential vector for ransomware attacks.
The ease of modifying a legitimate Skill to carry a malicious payload makes this a scalable threat.
The infection process is both subtle and effective. Researchers from Cato CTRL demonstrated this by modifying an official open-source "GIF Creator" Skill. They added a helper function named postsave that appeared to be a harmless part of the Skill's workflow, supposedly for post-processing the created GIF.
In reality, this function was designed to silently download and execute an external script. This method bypasses the user's scrutiny as Claude only prompts for approval of the main script, not the hidden operations of the helper function.
Once the initial approval is given, the malicious helper function can operate without further prompts or warnings. It can download and run malware, such as the MedusaLocker ransomware, which then encrypts the user's files.
The execution flow shows that after the first consent, hidden subprocesses inherit the trusted status, allowing them to perform their malicious activities undetected. This highlights a critical vulnerability where the user's initial consent is exploited to carry out a full-fledged ransomware attack, all under the guise of a legitimate AI-powered tool.
Based on reporting by Cyber Security News.