Alert Across the Internet! Claude Code Source Code Leak Triggers "Secondary Disaster": Hackers Set GitHub Phishing Traps

marsbitPubblicato 2026-04-03Pubblicato ultima volta 2026-04-03

Introduzione

A major security alert is circulating online following the accidental leak of Claude Code's source code by Anthropic. Hackers are exploiting the incident by creating fake GitHub repositories that distribute the information-stealing malware known as **Vidar**. Posing as a user named `idbzoomh`, the threat actor set up multiple repositories claiming to offer "unlocked enterprise features" from the leaked source code. These repositories are optimized for search engines to appear at the top of results for queries like “Claude Code leak,” increasing their reach. If a user downloads and executes the provided files, the Vidar malware is deployed. It is a sophisticated stealer designed to harvest sensitive data such as browser credentials, cryptocurrency wallets, and personal information. The attack also installs **GhostSocks**, a proxy tool that establishes hidden communication channels for remote control and data exfiltration. Security firm Zscaler notes that these malicious repositories update frequently, making it easier to bypass basic security scans. At least two similar repositories have been identified, suggesting the same attacker is testing different distribution methods. This incident highlights the compound risks in the AI era, where initial human error leads to secondary threats like social engineering. Developers are urged to obtain software only through official channels and avoid executing untrusted binaries.

According to an April 2nd report, the Claude Code source code leak incident caused by an Anthropic human error continues to escalate. Currently, hackers have exploited this hot topic to spread information-stealing malware named Vidar via fake repositories on GitHub.

Upgraded Bait: Claiming to "Unlock Enterprise-Level Features"

Monitoring reports from security company Zscaler show that a user named idbzoomh has created multiple fake repositories on GitHub.

Precision Phishing: The hacker claims in the repository description to provide leaked source code that "unlocks enterprise features," luring eager developers to download it.
SEO Optimization: To maximize the impact, the attackers optimized for search engine keywords, causing these malicious repositories to often rank at the top when users search for terms like "Claude Code leak".

Virus Profile: Vidar Infiltrates, Data "Relocated"

Once users are deceived into downloading and executing the contained executable files, the system is quickly compromised:

Information Theft: The implanted Vidar is a highly mature malware on the dark web, specifically designed to harvest browser account passwords, cryptocurrency wallets, and various types of sensitive personal information.
Persistent Latency: The virus also simultaneously deploys the GhostSocks proxy tool, setting up a secret channel for subsequent remote control and data exfiltration.

Risk Warning: Beware of "Free Lunches" from Unofficial Channels

Security researchers point out that the malicious compressed files in these fake repositories are updated at an extremely high frequency, making them easy to bypass basic security detection. At least two repositories with similar tactics have been discovered so far, suspected to be tests of different propagation strategies by the same attacker.

Industry Observation: The "Chain Set" of AI Security

From Anthropic's source code packaging mistake to hackers secondarily exploiting the hot topic for phishing, this incident reflects the complexity of security risks in the AI era. When the developer community becomes the target of attacks, basic digital literacy—not running binaries from unknown sources—remains the last line of defense.

Editors remind all developers: Please be sure to obtain tools through official Anthropic channels. Do not fall into the traps carefully designed by hackers out of curiosity or the pursuit of "cracked features."

Domande pertinenti

QWhat is the primary malware being distributed through the fake GitHub repositories related to the Claude Code leak?

AThe primary malware being distributed is called Vidar, which is a sophisticated information-stealing malware known for harvesting browser credentials, cryptocurrency wallets, and other sensitive personal data.

QHow are the attackers making their fake GitHub repositories more visible to potential victims?

AThe attackers are using Search Engine Optimization (SEO) techniques by including popular keywords like 'Claude Code leak' in the repository descriptions, causing these malicious repositories to appear at the top of search results.

QWhat additional tool does the Vidar malware deploy on an infected system to maintain persistence and enable data exfiltration?

AThe Vidar malware also deploys a tool called GhostSocks, which is a proxy utility that creates a secret channel for remote control and ongoing data exfiltration from the compromised system.

QWhat human error at Anthropic initially led to the situation that hackers are exploiting?

AThe initial event was a source code leak of Claude Code caused by a human error at Anthropic, where the code was mistakenly made available, creating the opportunity for hackers to use it as a lure.

QWhat is the main advice from security researchers to developers to avoid falling victim to these traps?

AThe main advice is to only obtain tools through official Anthropic channels and to avoid downloading or running binary files from unverified sources, emphasizing that basic digital hygiene is the last line of defense.

Letture associate

Platform Token Surges 15-Fold in Half a Month, Pons Tops Both Token Issuance and Trading on Robinhood Chain

The article details the rapid rise of Pons as the leading token launch and trading platform on Robinhood Chain. Following NOXA's halt of new token issuance, several platforms vied for the resulting traffic. By mid-July, Pons surged ahead, achieving the highest daily token creation volume (over 15,000 tokens on July 15th) and soon after capturing the largest daily trading volume ($40.7M on July 18th), consistently maintaining both top positions. Pons's key advantage is its streamlined, single-transaction process that deploys a token's contract and its Uniswap V3 liquidity pool simultaneously, eliminating the need for bonding curves or subsequent DEX migrations. This simplicity caters to the demand for fast, low-cost launches on Robinhood Chain. The platform's native token, PONS, played a pivotal role in its growth, experiencing a price surge of over 15x from mid-July. A tokenomics model that uses 80% of protocol fees to buy back and burn PONS has contributed to its value and heightened platform visibility. Looking ahead, Pons V2 aims to expand beyond meme tokens by integrating support for paying transaction fees with assets like USDG or RWA tokens, aligning with Robinhood Chain's focus on on-chain finance and real-world assets.

marsbit20 min fa

Platform Token Surges 15-Fold in Half a Month, Pons Tops Both Token Issuance and Trading on Robinhood Chain

marsbit20 min fa

Apple's Q3 Results Largely Meet Expectations, Supply and Memory Pressure Drive After-Hours Drop of 6%

Apple's Q3 (FY2026) earnings largely met expectations, but weak guidance and rising costs drove the stock down 6.3% after hours. Revenue of $109.42B slightly beat estimates, and EPS of $2.02 was boosted by a $0.11 tariff refund. Core EPS was $1.91, aligning with forecasts. iPhone and Mac sales were strong, but iPad and Services revenue fell short. Greater China growth slowed. The outlook for the next quarter is concerning. Apple guided for 9-11% revenue growth, below the ~12% consensus, citing significant supply constraints for iPhones, Macs, and iPads due to advanced chip shortages. Gross margin guidance of 47-48% includes a 1-point tariff benefit, implying a core margin of 46-47%, down from 48.1% this quarter. Management highlighted rising memory costs as a major pressure point. While Apple's AI initiatives like Siri are progressing, monetization remains early. With the stock near all-time highs, the combination of in-line results, segment weaknesses, and a cautious outlook triggered significant profit-taking. The focus has shifted from resilient demand to supply chain execution and cost management.

marsbit24 min fa

Apple's Q3 Results Largely Meet Expectations, Supply and Memory Pressure Drive After-Hours Drop of 6%

marsbit24 min fa

Platform Token Soars 15x in Half a Month, Pons Tops Robinhood Chain Charts for Both Token Launches and Trading

In just half a month, the Pons platform token (PONS) surged over 15x in value as Pons solidified its position as the leading token launch and trading platform on Robinhood Chain, capturing both the highest daily token creation volume and transaction volume. Following the exit of previous leader NOXA, competition initially favored Flap before Pons emerged dominant around mid-July. By July 26th, Pons accounted for 77.1% of total trading volume across all Robinhood Chain launchpads. Pons's success is attributed to its streamlined, one-transaction process for deploying a token contract and its corresponding Uniswap V3 liquidity pool simultaneously, eliminating the need for bonding curves or complex migrations. This simplicity, combined with low creation costs and immediate tradability, attracted significant creation activity and speculative trading. The meteoric rise of its native token, PONS, further fueled platform growth. A tokenomics model directing 80% of protocol fees to buy back and burn PONS created a reinforcing cycle: platform usage boosted PONS value, which in turn attracted more users. Looking ahead, Pons V2 aims to expand beyond meme tokens by integrating support for paying fees in stablecoins (USDG) and RWA assets, aligning with Robinhood Chain's broader focus on on-chain finance and stock tokens.

Odaily星球日报25 min fa

Platform Token Soars 15x in Half a Month, Pons Tops Robinhood Chain Charts for Both Token Launches and Trading

Odaily星球日报25 min fa

Qualcomm Chip Price Hike Deals a Blow to Android Phones

Qualcomm has officially announced a new round of price increases for its entire chip portfolio, effective September 1. The hikes, reaching up to 18% for the flagship Snapdragon 8 Elite Gen 6 Pro, follow similar moves by MediaTek, intensifying cost pressures on the already strained smartphone industry. CEO Cristiano Amon confirmed the plan, citing the need to offset rising industry-wide costs and restore declining profit margins. Qualcomm's Q3 FY2026 results showed a 25% drop in net profit, with mobile revenue plunging 20% year-over-year, hitting its lowest level since 2021. The surge in AI computing demand has led memory manufacturers to prioritize HBM production, creating a shortage in general-purpose DRAM and NAND Flash chips. Their prices soared by 93%-98% and 55%-60% respectively in Q1 2026, causing the memory cost share in smartphones to jump from 10%-15% to over 30%. Coupled with the soaring cost of advanced nodes like TSMC's 2nm and packaging, overall chip costs have reached historic highs. These upstream pressures are forcing downstream smartphone brands like Xiaomi, OPPO, and vivo to cut orders for mid-to-low-end models by up to 20% and use cost-saving measures like older chipsets. Reportedly, the Snapdragon 8E5 will be repurposed as a "long-lasting" chip for sub-brand phones in H2 2026. Amid this cost crisis, the Android market remains sluggish. Q2 2026 smartphone shipments in China fell 4.3% year-over-year, marking five consecutive quarters of decline. Major Android brands saw market share drop, while Huawei and Apple, with their in-house chip advantages, gained share. Qualcomm is diversifying into automotive and IoT sectors to reduce reliance on smartphones, but these new segments cannot yet fill the mobile revenue gap. Industry observers warn that the full impact of component cost hikes will hit in the second half of 2026, likely leading to higher-than-expected price increases for Android flagships and a further contraction in the Chinese smartphone market.

marsbit36 min fa

Qualcomm Chip Price Hike Deals a Blow to Android Phones

marsbit36 min fa

Breaking: GPT-5.6 Prices Slashed Effective Today

OpenAI has announced significant price cuts for its GPT-5.6 model API, effective immediately. The entry-level **GPT-5.6 Luna** sees the most drastic reduction, with input prices dropping 80% to $0.20 per million tokens and output prices falling to $1.20 per million tokens. The mid-tier **GPT-5.6 Terra** is reduced by 20%, now costing $2.00 (input) and $12.00 (output) per million tokens. The flagship **GPT-5.6 Sol** maintains its original price but introduces a new **Fast mode**, offering speeds up to 2.5 times faster for double the cost. The company attributes these price reductions to efficiency gains achieved through **GPT-5.6 Sol's own involvement in optimizing its production systems**. The model assisted in rewriting GPU kernels and improving speculative decoding, leading to a 20% reduction in end-to-end service costs and over 15% improvement in token generation efficiency. OpenAI emphasizes this process remained human-led. A key focus of the降价 is to lower the barrier for running **AI agent workflows**. By making the capable, tool-calling Luna model significantly cheaper, OpenAI aims to enable more frequent use in cost-sensitive, high-volume tasks like code review and monitoring. This creates a potential feedback loop: model-assisted efficiency gains lead to lower costs, which enables broader agent deployment, which in turn drives further optimization. The new pricing and features will also apply to Codex and ChatGPT Work subscriptions. The changes intensify competition in the large language model market, with OpenAI directly challenging rivals like Anthropic to respond.

marsbit1 h fa

Breaking: GPT-5.6 Prices Slashed Effective Today

marsbit1 h fa

Trading

Spot