Claude Code OAuth Tokens Can Be Stolen Through Stealthy MCP Hijacking