Alert Across the Internet! Claude Code Source Code Leak Triggers "Secondary Disaster": Hackers Set GitHub Phishing Traps

marsbitPubblicato 2026-04-03Pubblicato ultima volta 2026-04-03

Introduzione

A major security alert is circulating online following the accidental leak of Claude Code's source code by Anthropic. Hackers are exploiting the incident by creating fake GitHub repositories that distribute the information-stealing malware known as **Vidar**. Posing as a user named `idbzoomh`, the threat actor set up multiple repositories claiming to offer "unlocked enterprise features" from the leaked source code. These repositories are optimized for search engines to appear at the top of results for queries like “Claude Code leak,” increasing their reach. If a user downloads and executes the provided files, the Vidar malware is deployed. It is a sophisticated stealer designed to harvest sensitive data such as browser credentials, cryptocurrency wallets, and personal information. The attack also installs **GhostSocks**, a proxy tool that establishes hidden communication channels for remote control and data exfiltration. Security firm Zscaler notes that these malicious repositories update frequently, making it easier to bypass basic security scans. At least two similar repositories have been identified, suggesting the same attacker is testing different distribution methods. This incident highlights the compound risks in the AI era, where initial human error leads to secondary threats like social engineering. Developers are urged to obtain software only through official channels and avoid executing untrusted binaries.

According to an April 2nd report, the Claude Code source code leak incident caused by an Anthropic human error continues to escalate. Currently, hackers have exploited this hot topic to spread information-stealing malware named Vidar via fake repositories on GitHub.

Upgraded Bait: Claiming to "Unlock Enterprise-Level Features"

Monitoring reports from security company Zscaler show that a user named idbzoomh has created multiple fake repositories on GitHub.

Precision Phishing: The hacker claims in the repository description to provide leaked source code that "unlocks enterprise features," luring eager developers to download it.
SEO Optimization: To maximize the impact, the attackers optimized for search engine keywords, causing these malicious repositories to often rank at the top when users search for terms like "Claude Code leak".

Virus Profile: Vidar Infiltrates, Data "Relocated"

Once users are deceived into downloading and executing the contained executable files, the system is quickly compromised:

Information Theft: The implanted Vidar is a highly mature malware on the dark web, specifically designed to harvest browser account passwords, cryptocurrency wallets, and various types of sensitive personal information.
Persistent Latency: The virus also simultaneously deploys the GhostSocks proxy tool, setting up a secret channel for subsequent remote control and data exfiltration.

Risk Warning: Beware of "Free Lunches" from Unofficial Channels

Security researchers point out that the malicious compressed files in these fake repositories are updated at an extremely high frequency, making them easy to bypass basic security detection. At least two repositories with similar tactics have been discovered so far, suspected to be tests of different propagation strategies by the same attacker.

Industry Observation: The "Chain Set" of AI Security

From Anthropic's source code packaging mistake to hackers secondarily exploiting the hot topic for phishing, this incident reflects the complexity of security risks in the AI era. When the developer community becomes the target of attacks, basic digital literacy—not running binaries from unknown sources—remains the last line of defense.

Editors remind all developers: Please be sure to obtain tools through official Anthropic channels. Do not fall into the traps carefully designed by hackers out of curiosity or the pursuit of "cracked features."

Domande pertinenti

QWhat is the primary malware being distributed through the fake GitHub repositories related to the Claude Code leak?

AThe primary malware being distributed is called Vidar, which is a sophisticated information-stealing malware known for harvesting browser credentials, cryptocurrency wallets, and other sensitive personal data.

QHow are the attackers making their fake GitHub repositories more visible to potential victims?

AThe attackers are using Search Engine Optimization (SEO) techniques by including popular keywords like 'Claude Code leak' in the repository descriptions, causing these malicious repositories to appear at the top of search results.

QWhat additional tool does the Vidar malware deploy on an infected system to maintain persistence and enable data exfiltration?

AThe Vidar malware also deploys a tool called GhostSocks, which is a proxy utility that creates a secret channel for remote control and ongoing data exfiltration from the compromised system.

QWhat human error at Anthropic initially led to the situation that hackers are exploiting?

AThe initial event was a source code leak of Claude Code caused by a human error at Anthropic, where the code was mistakenly made available, creating the opportunity for hackers to use it as a lure.

QWhat is the main advice from security researchers to developers to avoid falling victim to these traps?

AThe main advice is to only obtain tools through official Anthropic channels and to avoid downloading or running binary files from unverified sources, emphasizing that basic digital hygiene is the last line of defense.

Letture associate

Upbit Rebalances 864B SHIB In Internal Wallet Move

South Korean cryptocurrency exchange Upbit moved a total of 864 billion SHIB (worth approximately $4 million) between its internal wallet addresses. The activity, involving transfers of 384 billion SHIB outbound and 480 billion SHIB inbound, occurred following a 36% SHIB price rally. On-chain data indicates this was a routine internal wallet rebalancing operation by the exchange, not a sell-off or liquidation event. The article cautions that while large on-chain transfers are highly visible, they require proper context and wallet labeling to interpret correctly. In this case, the movement between known Upbit addresses does not inherently signal a change in market supply or selling pressure for SHIB.

bitcoinist47 min fa

Upbit Rebalances 864B SHIB In Internal Wallet Move

bitcoinist47 min fa

Can Generative Models Finally Be Trained End-to-End? The Core Is a For Loop

This article introduces a novel training paradigm for generative models called Explorative Modeling (XM), which enables true end-to-end training. Traditionally, powerful generative models like autoregressive and diffusion models are not trained end-to-end. They are trained to predict a single small step but require iterative multi-step sampling for inference. This "exposure bias" leads to error accumulation and limits performance. The core challenge XM addresses is "mode blurring." In generative tasks, a single input (e.g., "generate a dog") corresponds to many valid outputs (multiple modes). Standard training objectives like reconstruction loss force the model to average these modes, producing unrealistic, blurry outputs. To avoid this, existing models break generation into many small, almost deterministic steps, sacrificing end-to-end training. XM tackles this by restructuring the training loop itself. Its key insight is to amplify "generative expressivity." For each training input, instead of generating one sample, the model generates K candidate outputs. Only the candidate closest to the real data is used for computing the loss and updating the model via backpropagation. This simple "best-of-K" mechanism is implemented as a short for-loop. By exploring multiple possibilities, the model learns to distribute its guesses across different modes rather than collapsing to their uninformative average. The paper demonstrates that "exploration" acts as a new, powerful scaling axis. Gains from XM increase with model size, data scale, and compute. Experiments show improvements in FID scores for image generation and significant efficiency gains, sometimes outperforming larger models without exploration. When pushed to the limit, XM enables fully single-step, end-to-end generative models. In robotics tasks, an "Explorative Policy" matched the performance of a 100-step Diffusion Policy with a single forward pass, drastically improving inference speed. While the best-of-K concept is not entirely new, the authors' contribution lies in formally understanding it as a direct method to boost generative expressivity without fragmenting the generation process. This work suggests that as models scale, enhancing exploration during training may become crucial for overcoming fundamental performance bottlenecks.

marsbit47 min fa

Can Generative Models Finally Be Trained End-to-End? The Core Is a For Loop

marsbit47 min fa

A Maximum of 20 Submissions Per Person? DeepMind Researcher Satirically 'Petitions' Against ICLR's New Rule

The International Conference on Learning Representations (ICLR) 2027 has introduced a new submission rule limiting authors to a maximum of 20 papers per conference. This policy, announced due to a 68% surge in submissions for ICLR 2026 that strained the review system, aims to ensure fair and informative peer review. Google DeepMind researcher Dan Roy responded with a sarcastic petition on X, calling the 20-paper cap "absurd" and claiming it would slow AI progress. His post mockingly argued that AI agents can now produce incremental research and that large language models (LLMs) already handle all reviewing, so output should be maximized. This satire critiques the broader trend of AI's role in academia, referencing a 2025 study that found about 21% of ICLR 2026 reviews were likely fully AI-generated. Roy's underlying point questions whether simply capping submissions addresses the systemic issue of AI potentially flooding conferences with agent-written papers and AI-assisted reviews. The debate highlights tensions between managing submission volume and maintaining research quality as AI tools become pervasive.

marsbit52 min fa

A Maximum of 20 Submissions Per Person? DeepMind Researcher Satirically 'Petitions' Against ICLR's New Rule

marsbit52 min fa

Coldcard Vulnerability Leads to $89 Million Theft, Sparking Largest On-Chain Migration Since FTX Collapse

A security vulnerability in Coldcard hardware wallets led to the theft of 1,367.05 BTC (approx. $89 million) from 4,585 addresses, according to Galaxy Research. The flaw, caused by insufficient randomness in seed phrase generation for specific firmware versions, triggered a massive migration of funds as users moved assets to new, secure wallets. This event caused the largest on-chain movement of small Bitcoin transactions since the FTX collapse, distorting key market indicators like active addresses and exchange deposits, and significantly dampening market sentiment. The incident also highlighted challenges in cybersecurity investigations, as researchers reported that safety guardrails on mainstream U.S. AI models hindered the analysis of attack patterns, forcing them to use an open-source Chinese AI model for forensic work. This underscores a dilemma in balancing AI security restrictions with the need for rapid response in tracing stolen crypto assets.

marsbit1 h fa

Coldcard Vulnerability Leads to $89 Million Theft, Sparking Largest On-Chain Migration Since FTX Collapse

marsbit1 h fa

Annual Salary of Millions Competing for Electricians, Meta Rushes to Open Its Own Technical School

The AI boom is facing an unexpected bottleneck: a severe shortage of skilled construction workers and electricians. As tech giants like Meta, OpenAI, and Alphabet race to build massive data centers—such as OpenAI's $16 billion "Stargate" project—they are hitting a critical labor wall. The U.S. needs an estimated 130,000 more electricians, 240,000 construction workers, and 150,000 supervisors by 2030 for AI infrastructure alone, but tens of thousands of electrician jobs go unfilled each year. While AI companies offer high premiums, with electricians earning up to $280,000 annually, worker scarcity still causes massive losses—delays on a single project can cost $14.2 million per month. The complexity of building AI data centers, which require immense power (equivalent to powering hundreds of thousands of homes), sophisticated electrical systems, and advanced liquid cooling solutions, demands highly skilled technicians who are in short supply. To combat this, companies are investing heavily in training. Meta has committed $115 million to a free training school offering tuition, housing, and stipends, targeting 5,000 new workers. OpenAI is partnering with unions to secure skilled labor. These efforts are paying off, with a significant rise in Gen Z interest in trade schools over college. However, the power demands are staggering. AI data centers are driving a rapid surge in electricity consumption, projected to account for up to 12% of U.S. power use by 2028 and raising costs for consumers. Furthermore, the construction boom is project-based, leading to a potential future glut of trained workers once building peaks, which could depress wages industry-wide. The race for AI supremacy now depends as much on skilled hands as on advanced chips.

marsbit2 h fa

Annual Salary of Millions Competing for Electricians, Meta Rushes to Open Its Own Technical School

marsbit2 h fa

Trading

Spot