AI Briefingclaude-mem Detected as Trojan by Kaspersky
Key point
claude-mem is classified as a high-risk Trojan by Kaspersky due to its periodic credential queries via PowerShell
Details
Reports have emerged of the AI memory management tool claude-mem being detected as a high-risk Trojan by Kaspersky security software, prompting users to consider immediate removal.
Detection Cause and Technical Behavior
Kaspersky classified a temporary DLL file (xi3ofare.dll) compiled by PowerShell as VHO:Trojan.MSIL.Rozena.gen. This is because claude-mem dynamically executes C# code via PowerShell to call the Windows native API CredRead.
- claude-mem uses this method to retrieve Claude Code login tokens every 30 seconds.
- Even without malicious intent, the repeated use of dynamic PowerShell shells to access credentials can be considered a threat by the heuristic analysis of security software.
Security Implications
While this behavior may technically be a heuristic false positive, it is reasonable for security software to block it due to its similarity to patterns of periodically stealing credentials. Developers should review their credential access methods or provide clear exception handling instructions to users to avoid such security warnings.
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.