Alert the entire network! Claude Code source code leak triggers a "secondary disaster": hackers set up GitHub phishing traps

null

April 2 reports: The Claude Code source code leak incident caused by human error from Anthropic is still gaining momentum. At present, hackers have been leveraging this hot topic to spread a malicious software information-stealing package called Vidar on GitHub through fake repositories.

Decoy upgrade: claims to “unlock enterprise-level features”

Monitoring reports from security firm Zscaler show that a user named idbzoomh created multiple fake repositories on GitHub.

Targeted phishing: In the repository description, the hacker claims to provide a leaked version of source code that “unlocks enterprise features,” luring developers who are eager to try it out to download it.

SEO optimization: To increase the impact, the attackers optimized keywords for search engines, causing these malicious repositories to often appear near the top of results when users search for keywords such as “Claude Code leak.”

Virus profile: Vidar infiltrates, data “migrates”

Once users believe it and download and run the executable files inside, the systems are quickly compromised:

Information theft: The implanted Vidar is a highly mature piece of malware on the dark web, designed specifically to harvest browser account passwords, cryptocurrency wallets, and various types of sensitive personal information.

Persistent presence: The virus also deploys the GhostSocks proxy tool to set up a secret channel for subsequent remote control and data exfiltration.

Risk alert: beware of the “free lunch” from unofficial channels

Security researchers point out that these fake repositories’ malicious compressed archives are updated at an extremely high frequency, making them easy to bypass basic security detection. At least two repositories with similar tactics have already been found, suggesting the same attacker may be testing different propagation strategies.

Industry watch: AI security’s “chain trap”

From Anthropic’s source code packaging mishap, to hackers reusing the hotspot for phishing, this incident reflects the complexity of security risks in the AI era. When developer communities become targets of attack, basic digital literacy—such as not running binary files from unknown sources—still remains the final line of defense.

Editor’s note to all developers: Please be sure to obtain tools through Anthropic’s official channels, and do not fall into traps carefully designed by hackers out of curiosity or in pursuit of “cracked features.”