Alert Across the Internet! Claude Code Source Code Leak Triggers "Secondary Disaster": Hackers Set GitHub Phishing Traps

marsbitPublicado em 2026-04-03Última atualização em 2026-04-03

Resumo

A major security alert is circulating online following the accidental leak of Claude Code's source code by Anthropic. Hackers are exploiting the incident by creating fake GitHub repositories that distribute the information-stealing malware known as **Vidar**. Posing as a user named `idbzoomh`, the threat actor set up multiple repositories claiming to offer "unlocked enterprise features" from the leaked source code. These repositories are optimized for search engines to appear at the top of results for queries like “Claude Code leak,” increasing their reach. If a user downloads and executes the provided files, the Vidar malware is deployed. It is a sophisticated stealer designed to harvest sensitive data such as browser credentials, cryptocurrency wallets, and personal information. The attack also installs **GhostSocks**, a proxy tool that establishes hidden communication channels for remote control and data exfiltration. Security firm Zscaler notes that these malicious repositories update frequently, making it easier to bypass basic security scans. At least two similar repositories have been identified, suggesting the same attacker is testing different distribution methods. This incident highlights the compound risks in the AI era, where initial human error leads to secondary threats like social engineering. Developers are urged to obtain software only through official channels and avoid executing untrusted binaries.

According to an April 2nd report, the Claude Code source code leak incident caused by an Anthropic human error continues to escalate. Currently, hackers have exploited this hot topic to spread information-stealing malware named Vidar via fake repositories on GitHub.

Upgraded Bait: Claiming to "Unlock Enterprise-Level Features"

Monitoring reports from security company Zscaler show that a user named idbzoomh has created multiple fake repositories on GitHub.

  • Precision Phishing: The hacker claims in the repository description to provide leaked source code that "unlocks enterprise features," luring eager developers to download it.

  • SEO Optimization: To maximize the impact, the attackers optimized for search engine keywords, causing these malicious repositories to often rank at the top when users search for terms like "Claude Code leak".

Virus Profile: Vidar Infiltrates, Data "Relocated"

Once users are deceived into downloading and executing the contained executable files, the system is quickly compromised:

  • Information Theft: The implanted Vidar is a highly mature malware on the dark web, specifically designed to harvest browser account passwords, cryptocurrency wallets, and various types of sensitive personal information.

  • Persistent Latency: The virus also simultaneously deploys the GhostSocks proxy tool, setting up a secret channel for subsequent remote control and data exfiltration.

Risk Warning: Beware of "Free Lunches" from Unofficial Channels

Security researchers point out that the malicious compressed files in these fake repositories are updated at an extremely high frequency, making them easy to bypass basic security detection. At least two repositories with similar tactics have been discovered so far, suspected to be tests of different propagation strategies by the same attacker.

Industry Observation: The "Chain Set" of AI Security

From Anthropic's source code packaging mistake to hackers secondarily exploiting the hot topic for phishing, this incident reflects the complexity of security risks in the AI era. When the developer community becomes the target of attacks, basic digital literacy—not running binaries from unknown sources—remains the last line of defense.

Editors remind all developers: Please be sure to obtain tools through official Anthropic channels. Do not fall into the traps carefully designed by hackers out of curiosity or the pursuit of "cracked features."

Perguntas relacionadas

QWhat is the primary malware being distributed through the fake GitHub repositories related to the Claude Code leak?

AThe primary malware being distributed is called Vidar, which is a sophisticated information-stealing malware known for harvesting browser credentials, cryptocurrency wallets, and other sensitive personal data.

QHow are the attackers making their fake GitHub repositories more visible to potential victims?

AThe attackers are using Search Engine Optimization (SEO) techniques by including popular keywords like 'Claude Code leak' in the repository descriptions, causing these malicious repositories to appear at the top of search results.

QWhat additional tool does the Vidar malware deploy on an infected system to maintain persistence and enable data exfiltration?

AThe Vidar malware also deploys a tool called GhostSocks, which is a proxy utility that creates a secret channel for remote control and ongoing data exfiltration from the compromised system.

QWhat human error at Anthropic initially led to the situation that hackers are exploiting?

AThe initial event was a source code leak of Claude Code caused by a human error at Anthropic, where the code was mistakenly made available, creating the opportunity for hackers to use it as a lure.

QWhat is the main advice from security researchers to developers to avoid falling victim to these traps?

AThe main advice is to only obtain tools through official Anthropic channels and to avoid downloading or running binary files from unverified sources, emphasizing that basic digital hygiene is the last line of defense.

Leituras Relacionadas

‘1:1 backed equities scale much better,’ Base claims amid Robinhood rivalry

Base co-founder Jesse Pollak acknowledged that Robinhood Chain has an early lead in offering tokenized equities on an EVM-compatible chain, an area where Base has lagged. However, Pollak downplayed the competitive threat, claiming Base's upcoming 1:1 backed tokenized equities (versus Robinhood's derivatives) will offer superior scalability, trust, and capital efficiency. Despite being only weeks old, Robinhood Chain has rapidly gained traction, now rivaling Base in key metrics like weekly active users (~1 million each), DEX volume, and revenue. Analysts note Robinhood's massive existing user base of 27 million funded accounts gives it a significant distribution advantage as retail trading moves on-chain.

ambcryptoHá 46m

‘1:1 backed equities scale much better,’ Base claims amid Robinhood rivalry

ambcryptoHá 46m

TON/GRAM price prediction – Telegram’s Gram wallet rollout lifts token: Can the rally continue?

Telegram founder Pavel Durov announced the rollout of a native, non-custodial Gram wallet across the messaging app, describing it as potentially the largest deployment of a non-custodial wallet in history. The move aims to bring instant, zero-fee crypto transactions to Telegram's over one billion users, integrating digital assets directly into the platform. The news triggered a more than 7% price increase for TON/GRAM, pushing the token to around $1.53. However, it remains below its May peak near $2.80, facing immediate resistance around $1.60. Analysts suggest a break above this level could improve sentiment toward $1.80, while a failure to hold gains might see a retest of support near $1.40.

ambcryptoHá 1h

TON/GRAM price prediction – Telegram’s Gram wallet rollout lifts token: Can the rally continue?

ambcryptoHá 1h

How 40.8M staked ETH could strengthen Ethereum’s edge over Bitcoin

Ethereum is showing signs of strengthening against Bitcoin, driven by two key trends. First, significant whale accumulation is occurring, with large holders not just buying ETH but immediately staking 100% of it. This locks away supply, signaling long-term conviction. Ethereum's total staked ETH has reached a record 40.8 million, with a growing entry queue and 33.5% of supply now staked, further tightening liquid availability. Second, Ethereum's DeFi ecosystem is experiencing robust activity, with WETH whale transactions at a multi-year high and Total Value Locked (TVL) rising sharply. These converging factors—reduced supply from staking and increased on-chain demand—are translating into technical strength. The ETH/BTC ratio has broken above resistance and is approaching the 0.03 level, setting the stage for potential continued outperformance against Bitcoin.

ambcryptoHá 1h

How 40.8M staked ETH could strengthen Ethereum’s edge over Bitcoin

ambcryptoHá 1h

Global Stock Market's Storm Center: South Korea's Stock Market De-leveraging Is Largely Complete

Storm's Eye: South Korean Market De-leveraging Nears Completion The recent sharp correction in South Korean equities, with the KOSPI index dropping 32% from its June high, has been a key trigger for global tech stock volatility. The core driver was not a fundamental shift but a forced de-leveraging process within the market's unique structure, which is now largely complete. Two main leverage channels amplified the sell-off: 1. **Leveraged ETFs:** Their size, proportionally four times larger than in the U.S., peaked near $50 billion. Their mandatory daily rebalancing mechanism created a vicious cycle of "price drop → forced selling → further drop." Approximately 75% of this excess has been unwound, shrinking to $26 billion, with regulatory curbs now blocking new inflows. 2. **Hedge Fund Leverage:** Using swaps to magnify exposure, hedge funds saw their net long positioning fall by over 50% from peak levels. The most intense phase of this institutional de-leveraging is over. In contrast, **retail margin debt** poses minimal systemic risk. At 0.5% of market cap, it is far lower than in the U.S. or China, lacks automatic triggers, and is concentrated in smaller stocks. The conclusion: the high-leverage structures most prone to "chain-reaction selling" have been substantially cleared. The market is transitioning from a liquidity-driven crash to one priced more on fundamentals. The article argues that the AI trend—centered on Korean memory chips—remains intact. This episode represents a painful but necessary clearing of crowded trades, not the end of the AI revolution. For investors, the key question is conviction in the long-term AI direction; if the trend is real, current volatility is a cost of entry, not a terminal risk.

链捕手Há 1h

Global Stock Market's Storm Center: South Korea's Stock Market De-leveraging Is Largely Complete

链捕手Há 1h

92.9% of crypto tokens launched since 2024 trade below TGE price: CryptoRank

A recent analysis by CryptoRank reveals that 92.9% of cryptocurrency tokens launched since 2024 and with a market capitalization exceeding $100 million are now trading below their initial Token Generation Event (TGE) price. The study, examining 113 projects, found only eight—or 7.1%—remain profitable, with the median return across the dataset being a stark -95.7%. Top performers include Hyperliquid (HYPE), which gained 1,519%, followed by Ondo Finance (ONDO), EverValue Coin (EVA), and Midnight Network (NIGHT). The findings indicate a market that has become highly selective, with capital concentrating on a small number of projects demonstrating real utility, adoption, or ecosystem growth. This contrasts with previous cycles where new tokens often saw sustained rallies. Investors are now scrutinizing factors like tokenomics, circulating supply, and unlock schedules more closely. This trend may influence future token launches, prompting projects to prioritize sustainable distribution models and long-term growth over aggressive initial valuations, as high fully diluted valuations (FDVs) and large future token unlocks often lead to significant price pressure.

ambcryptoHá 1h

92.9% of crypto tokens launched since 2024 trade below TGE price: CryptoRank

ambcryptoHá 1h

Trading

Spot
活动图片

Categorias popularesright-arrow

Etiquetas Popularesright-arrow