Alert Across the Internet! Claude Code Source Code Leak Triggers "Secondary Disaster": Hackers Set GitHub Phishing Traps

marsbitPubblicato 2026-04-03Pubblicato ultima volta 2026-04-03

Introduzione

A major security alert is circulating online following the accidental leak of Claude Code's source code by Anthropic. Hackers are exploiting the incident by creating fake GitHub repositories that distribute the information-stealing malware known as **Vidar**. Posing as a user named `idbzoomh`, the threat actor set up multiple repositories claiming to offer "unlocked enterprise features" from the leaked source code. These repositories are optimized for search engines to appear at the top of results for queries like “Claude Code leak,” increasing their reach. If a user downloads and executes the provided files, the Vidar malware is deployed. It is a sophisticated stealer designed to harvest sensitive data such as browser credentials, cryptocurrency wallets, and personal information. The attack also installs **GhostSocks**, a proxy tool that establishes hidden communication channels for remote control and data exfiltration. Security firm Zscaler notes that these malicious repositories update frequently, making it easier to bypass basic security scans. At least two similar repositories have been identified, suggesting the same attacker is testing different distribution methods. This incident highlights the compound risks in the AI era, where initial human error leads to secondary threats like social engineering. Developers are urged to obtain software only through official channels and avoid executing untrusted binaries.

According to an April 2nd report, the Claude Code source code leak incident caused by an Anthropic human error continues to escalate. Currently, hackers have exploited this hot topic to spread information-stealing malware named Vidar via fake repositories on GitHub.

Upgraded Bait: Claiming to "Unlock Enterprise-Level Features"

Monitoring reports from security company Zscaler show that a user named idbzoomh has created multiple fake repositories on GitHub.

Precision Phishing: The hacker claims in the repository description to provide leaked source code that "unlocks enterprise features," luring eager developers to download it.
SEO Optimization: To maximize the impact, the attackers optimized for search engine keywords, causing these malicious repositories to often rank at the top when users search for terms like "Claude Code leak".

Virus Profile: Vidar Infiltrates, Data "Relocated"

Once users are deceived into downloading and executing the contained executable files, the system is quickly compromised:

Information Theft: The implanted Vidar is a highly mature malware on the dark web, specifically designed to harvest browser account passwords, cryptocurrency wallets, and various types of sensitive personal information.
Persistent Latency: The virus also simultaneously deploys the GhostSocks proxy tool, setting up a secret channel for subsequent remote control and data exfiltration.

Risk Warning: Beware of "Free Lunches" from Unofficial Channels

Security researchers point out that the malicious compressed files in these fake repositories are updated at an extremely high frequency, making them easy to bypass basic security detection. At least two repositories with similar tactics have been discovered so far, suspected to be tests of different propagation strategies by the same attacker.

Industry Observation: The "Chain Set" of AI Security

From Anthropic's source code packaging mistake to hackers secondarily exploiting the hot topic for phishing, this incident reflects the complexity of security risks in the AI era. When the developer community becomes the target of attacks, basic digital literacy—not running binaries from unknown sources—remains the last line of defense.

Editors remind all developers: Please be sure to obtain tools through official Anthropic channels. Do not fall into the traps carefully designed by hackers out of curiosity or the pursuit of "cracked features."

Domande pertinenti

QWhat is the primary malware being distributed through the fake GitHub repositories related to the Claude Code leak?

AThe primary malware being distributed is called Vidar, which is a sophisticated information-stealing malware known for harvesting browser credentials, cryptocurrency wallets, and other sensitive personal data.

QHow are the attackers making their fake GitHub repositories more visible to potential victims?

AThe attackers are using Search Engine Optimization (SEO) techniques by including popular keywords like 'Claude Code leak' in the repository descriptions, causing these malicious repositories to appear at the top of search results.

QWhat additional tool does the Vidar malware deploy on an infected system to maintain persistence and enable data exfiltration?

AThe Vidar malware also deploys a tool called GhostSocks, which is a proxy utility that creates a secret channel for remote control and ongoing data exfiltration from the compromised system.

QWhat human error at Anthropic initially led to the situation that hackers are exploiting?

AThe initial event was a source code leak of Claude Code caused by a human error at Anthropic, where the code was mistakenly made available, creating the opportunity for hackers to use it as a lure.

QWhat is the main advice from security researchers to developers to avoid falling victim to these traps?

AThe main advice is to only obtain tools through official Anthropic channels and to avoid downloading or running binary files from unverified sources, emphasizing that basic digital hygiene is the last line of defense.

Letture associate

Prediction Markets Surpassed Cryptocurrencies: Robinhood Earned $1.31 Billion in Q2

Robinhood posted record Q2 2026 revenue of $1.31 billion and net income of $573 million. Notably, nearly 23% of the profit came from one-time items, primarily the deconsolidation of a ventures fund. A key shift was the explosive growth of its prediction markets business, with event contract revenue surging over 10x year-over-year to $156 million, surpassing revenue from stocks ($129M) and cryptocurrencies ($100M). Cryptocurrency revenue declined 38% organically, but the company is aggressively expanding its crypto infrastructure through acquisitions, launching its own blockchain (Robinhood Chain), and offering new products like tokenized stocks and perpetual futures. Overall transaction revenue grew 44% to $776 million, with options remaining the largest single component at $342 million.

cryptonews.ru12 min fa

Prediction Markets Surpassed Cryptocurrencies: Robinhood Earned $1.31 Billion in Q2

cryptonews.ru12 min fa

Dash Launches ZK-Privacy Based on Zcash

Dash has launched ZK-based privacy features built on Zcash's Orchard protocol. This is now integrated directly into the Dash Platform's consensus (v4.0.0), providing a native, non-custodial privacy model alongside the existing CoinJoin system. It offers optional confidentiality, hiding sender, receiver, amount, and balance within a shielded pool. The implementation adapts Zcash's Orchard protocol (using Halo 2 without a trusted setup) to Dash Platform, handling state transitions, GroveDB storage, fees, and wallet sync. A critical double-spend vulnerability discovered in Orchard prior to release was patched using updated libraries, with Dash adding a SumTree structure for extra security. Users can privately transfer Platform Credits (pegged 1:100 billion to DASH) and move funds to/from the main Dash Core chain. Wallet synchronization, which is required to detect incoming private transactions, took about 21 seconds in testing, noted as significantly faster than a comparable Zcash wallet. Future plans include extending shielded pools to native Platform tokens and NFTs, aiming to combine ZK-privacy with token issuance and direct exchangeability with Dash. Mobile wallet support for the new feature is expected soon.

cryptonews.ru13 min fa

cryptonews.ru13 min fa

Well-known Investor Targets Nvidia: AI Boom Overly Reliant on It

Renowned investors Mark Cuban and Michael Burry have issued warnings about Nvidia's central role in the AI ecosystem, drawing parallels to the dot-com bubble. Cuban expressed concerns that Nvidia, by financing its clients' purchases of its GPUs for data centers, has positioned itself as a critical but vulnerable linchpin in the AI boom. He warned that a breakthrough from a competitor or a single misstep could trigger a widespread collapse. Similarly, Michael Burry pointed to the parabolic rise in the cost of insuring Nvidia's debt (CDS) as a sign of market fears over the company's overextension. He suggested Nvidia has pushed cyclical spending to an epic scale through numerous financing deals, creating significant risk. Both investors cautioned that overinvestment in AI infrastructure and potential oversupply could lead to a painful downturn, with Burry also revealing he has increased his short position and holds put options against Nvidia.

marsbit14 min fa

Well-known Investor Targets Nvidia: AI Boom Overly Reliant on It

marsbit14 min fa

OpenAI, Open-Sourced

OpenAI has open-sourced its code security tool, Codex Security CLI. The tool, which originated from the private beta project Aardvark in October 2025, is designed to automatically discover, verify, and fix vulnerabilities in codebases. It functions as an application security agent, first analyzing a repository to build a threat model, then identifying and ranking vulnerabilities based on real-world impact, and finally testing them in a sandbox for validation. According to OpenAI, in its first 30 days, the tool scanned over 1.2 million commits, uncovering 792 critical and 10,561 high-severity vulnerabilities, with a reported reduction of over 50% in false positives upon repeated scans of the same repositories. However, initial user experiences on platforms like Hacker News highlighted significant issues, particularly concerning cost and reliability. Developers reported failed scans that consumed substantial portions of API rate limits and incurred high expenses, with one user noting a cost of approximately $13 for an aborted run. The high cost is attributed to the tool's default configuration, which uses the premium GPT-5.6-sol model with inference intensity set to "extra-high." The release follows public statements by NVIDIA's Jensen Huang advocating for open-source AI. While OpenAI has open-sourced the application-layer CLI and SDK, the core AI models remain proprietary. The move opens the door for community development and potential adaptations of the tool.

marsbit16 min fa

marsbit16 min fa

Morgan Stanley Launches Two More Crypto ETFs, Shatters Market with 0.14% Fee Rate

Morgan Stanley launched two new crypto ETFs, the Morgan Stanley Ethereum Trust (MSSE) and the Morgan Stanley Solana Trust (MSOL), which debuted with a combined trading volume of $38 million. MSSE saw net inflows of $5.15 million, while MSOL saw high trading volume but no net new shares. Both products offer staking rewards. Morgan Stanley is competing aggressively on price, charging a total management and staking fee of just 0.14%, significantly undercutting major competitors like Bitwise, Grayscale, and BlackRock in both the Ethereum and Solana ETF sectors. While these new funds face the challenge of catching up to the substantial assets and liquidity of established first-mover ETFs, analysts note Morgan Stanley's distinct advantage lies in its vast wealth management network, which includes thousands of financial advisors and trillions in client assets, potentially allowing it to tap into a much broader mainstream investor base.

marsbit18 min fa

Morgan Stanley Launches Two More Crypto ETFs, Shatters Market with 0.14% Fee Rate

marsbit18 min fa

Trading

Spot