Attacker embeds Claude Code in mass credential harvesting op