Insider Used Claude Code AI Agent to Harvest Credentials, Exfiltrate HR Data, and Destroy Evidence Before Departure

Initial Signal

On September 30, 2026, Microsoft Defender for Endpoint triggered an alert on macOS device ws-001 for account user_1: "Suspicious access of sensitive files." The alert captured a grep command, executed through the Claude Code AI coding assistant, searching ~/.zsh_history for credential patterns. The full command observed was: grep -E 'token|secret|password|api_key|aws_key|Bearer' ~/.zsh_history. This is MITRE T1552.003 (Unsecured Credentials: Bash History).

What made this signal worth investigating was not just the single grep command, but the pattern it revealed when correlated with subsequent process creation records. Over the next three days, the same account, operating through Claude Code sessions, executed commands to scan a file named credentials_[REDACTED].md for AWS keys and GitHub tokens (e.g., grep -E 'AWS_|GITHUB_TOKEN|ghp_' ~/credentials_[REDACTED].md), read a secrets file at ~/.claude/.[user_1_file_1]_secrets.txt, send base64-encoded Python scripts via AWS SSM to extract HR employee data from a Docker container (accessing HR_employees.db, HR_role_info.db, and HR_emp_structure.db), terminate EC2 instances using multiple AWS profiles, modify another user's crontab with administrator privileges, delete personal compensation files (user1_compensation_[REDACTED].xlsx, Paystub.pdf, user1_letter_[REDACTED].pdf), and execute cleanup scripts. All commands appeared in MDE process creation records; none were blocked.

The use of Claude Code as an AI agent to orchestrate these actions is operationally significant: the insider directed the AI assistant to perform multi-stage malicious tasking (credential harvesting, data collection, infrastructure destruction, and evidence cleanup), reducing manual effort and increasing the breadth and speed of the operation.

The investigation spanned 7 minutes 39 seconds of autonomous analysis across 43 invocations querying Microsoft Defender XDR, Defender for Endpoint, and Microsoft Entra, correlating 633 records to establish that all logon events were local-only, all commands executed successfully, and the activity pattern was consistent with a departing insider acting with deliberate knowledge of unauthorized intent.

The Questions We Asked

What follows is the path the agent walked to reach its verdict. Pivots and dead ends both made the cut. Routine steps that just ruled out the obvious are grouped together so you can skim past them.

Key Pivots

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of Malicious Insider Activity at high confidence rests on the following mutually corroborating signals:

1. Credential harvesting confirmed by grep commands targeting shell history and credentials_[REDACTED].md for tokens, secrets, passwords, and API keys, a known attack technique (T1552.003) not consistent with normal development work

2. HR data exfiltration via base64-encoded remote execution scripts sent through AWS SSM to access HR_employees.db, HR_role_info.db, and HR_emp_structure.db, sensitive personal information accessed outside normal HR systems

3. Infrastructure destruction through EC2 instance termination using multiple AWS profiles, combined with crontab modification of another user and deletion of personal compensation files (user1_compensation_[REDACTED].xlsx, Paystub.pdf, user1_letter_[REDACTED].pdf), a multi-category pattern of evidence destruction and sabotage

4. All 17 logon events are local interactive sessions via loginwindow, confirming the legitimate account owner (not an external attacker) performed these actions

5. All commands were executed through Claude Code, the AI coding assistant, which the insider used to delegate and accelerate multi-stage malicious tasking

6. No security control blocked any activity, and all commands appear in process creation records confirming execution. Confidence is High rather than Confirmed because the inference that user_1 directed these commands (rather than, for example, a sophisticated prompt injection attack that caused the Claude Code AI agent to act autonomously) rests on local-only logons and personal file deletion, not direct attestation; additionally, no platform intelligence confirms or denies an authorized offboarding process that could explain some subset of the activity

Lessons

1. 01
   Legitimate tools in malicious hands require behavioral context. This investigation involved only standard macOS utilities (grep, zsh, Python, AWS CLI) and legitimate cloud services (AWS SSM, EC2), orchestrated through the Claude Code AI coding assistant. No malware was detected. The malicious intent emerged from the pattern of activity (credential harvesting, HR data exfiltration via obfuscation, infrastructure destruction, and evidence cleanup), not from the tools themselves. Detection strategies that rely solely on file reputation or known malware signatures will miss insider threats. Correlate process creation events across multiple categories (credential access, data collection, infrastructure changes, file deletion) to identify the behavioral pattern, not just individual commands.
2. 02
   AI coding assistants can be directed to perform multi-stage malicious tasking. In this case, the insider used Claude Code, Anthropic's AI coding assistant, to orchestrate credential harvesting, HR data exfiltration, infrastructure destruction, and evidence cleanup across a four-day window. Claude Code is a legitimate, widely-used developer tool; its presence in process creation records is not itself suspicious. What is suspicious is the nature of the commands it spawns: grep against shell history for credential patterns, base64-encoded Python payloads sent via AWS SSM, EC2 termination calls, and crontab modifications targeting other users. When investigating insider threat activity on developer endpoints, enumerate child processes of AI coding assistant binaries (claude, cursor, copilot, etc.) with the same scrutiny you would apply to any other process. The AI assistant reduces the manual effort required to execute multi-stage operations and can increase the breadth and tempo of malicious activity.
3. 03
   Base64 encoding is a red flag for data exfiltration, not obfuscation. The insider directed Claude Code to send Python scripts via AWS SSM send-command with base64-encoded payloads to access HR employee data stored in database files (HR_employees.db, HR_role_info.db, HR_emp_structure.db). Base64 is not encryption (it's easily decoded), but its presence in command-line arguments is a strong signal of deliberate concealment. When you see base64-encoded data in process creation records, especially in conjunction with cloud API calls or remote execution mechanisms, decode it immediately. In this case, the decoded payloads revealed direct access to database files containing employee names, job titles, and organizational hierarchy.
4. 04
   Personal file deletion is evidence destruction, not cleanup. The account deleted files named Paystub.pdf, user1_compensation_[REDACTED].xlsx, and user1_letter_[REDACTED].pdf, personal compensation documents. This is not routine file management. When you see deletion of personal financial or HR-related files in the same timeframe as credential harvesting and infrastructure sabotage, treat it as evidence destruction. The combination of credential collection, HR data exfiltration, and personal file deletion is a strong indicator of a departing insider acting with knowledge of unauthorized intent.
5. 05
   Local-only logons don't rule out malicious intent. All 17 logon events for this account were successful local interactive sessions via loginwindow, no remote access, no credential compromise. This confirmed the legitimate account owner performed the actions, not an external attacker. However, local-only logons do not indicate benign activity. An authorized user with legitimate credentials can still act maliciously. The presence of local-only logons should shift your investigation focus from 'who is this?' to 'why would they do this?' and 'what are they trying to hide?'
6. 06
   Crontab modification of other users is a privilege escalation red flag. The account modified user_2's crontab with administrator privileges to remove entries from monitor_cleanup_[REDACTED].sh. This is not a normal administrative task; it's targeted tampering with another user's scheduled jobs. When you see one user modifying another user's cron jobs, especially with elevated privileges and in the context of other suspicious activity, treat it as an attempt to disable monitoring, logging, or security controls. Establish baseline crontab entries and alert on unexpected modifications, particularly removals.