Claude Code found a backdoor and spyware on two MacBooks. mine and my friend's. everything was going to a guy named Li Wei on a Tencent Cloud server in Shenzhen. we checked our phones first. both clean. the MacBooks weren't. $230,000 in ETH vanished from my wallet. my friend kept losing access to his accounts no matter how many times he changed passwords. we put both MacBooks on the table and Claude Code found the same backdoor on both. on my M1 Pro it: stole my MetaMask wallet keys $230,000 in ETH sent out at 4am to 0x8a7d...3f1e on his M5 Pro it: dumped every saved password from Safari and Chrome copied active session cookies for gmail, twitter, coinbase grabbed his 2FA backup codes all going to Li Wei's server: IP → 119.28.***.47 location → Shenzhen, China provider → Tencent Cloud attacker OS → Windows 11 Pro hostname → DESKTOP-LI4*** panel language → zh-CN last ping from my Mac → 40.7**, -73.9** · 3 min ago it was still sending my location while i was scanning it. how it got in: a Chrome extension called "Notion Web Clipper" with 12 reviews. i installed it from a google ad. the real one has 400,000+ users. this one had 12. Chrome Sync pushed it to his browser automatically. i was the reason he kept getting hacked. changed every password from our phones. not from either Mac. the full step by step is below. takes 3 minutes. save it so you don't lose it and send it to anyone with a MacBook.