Hackers exploit Claude Code leak to spread credential-stealing malware via fake GitHub repos

Threat Actors Weaponize Claude Code Leak

Cybercriminals moved swiftly to exploit the accidental Claude Code leak from Anthropic, creating fake GitHub repositories that deliver malware instead of the promised source code. On March 31, Anthropic inadvertently exposed the full client-side source code of its terminal-based AI agent through a 59.8 MB JavaScript source map accidentally included in the published npm package3

3

. The leak contained 513,000 lines of unobfuscated TypeScript across 1,906 files, revealing orchestration logic, permissions, execution systems, and hidden features3

3

.

Malicious Campaign Delivers Vidar and Ghostsocks

Cybersecurity firm Zscaler identified a malicious GitHub page from the account "idbzoomh" that claims to offer the leaked source code while actually distributing credential-stealing malware1

1

. The deceptive repositories advertise "unlocked enterprise features" and no usage restrictions to lure victims3

3

. When users download the malicious .7z archive named "Claude Code - Leaked Source Code," they receive a Rust-based dropper executable called ClaudeCode_x64.exe2

2

. This dropper deploys Vidar v18.7, an information stealer that collects account credentials, credit card data, and browser history, alongside GhostSocks, a network traffic proxy tool that turns infected devices into proxy infrastructure for cybercriminals2

2

.

Search Engine Optimization Amplifies Threat

The fake GitHub repositories were optimized for search engine results, appearing near the top of Google searches for queries like "leaked Claude Code"3

3

. At least two trojanized Claude Code repositories remained active on GitHub at the time of reporting, with one accumulating 793 forks and 564 stars2

2

. Tens of thousands of people eagerly downloaded what they believed was the leaked source code this week2

2

. The malicious page even includes disclaimers about security alerts, claiming the application is "an experimental tool for Security Research" to avoid arousing suspicion when antivirus software triggers warnings1

1

.

Broader Pattern of AI-Related Exploitation

This malicious campaign follows a similar pattern observed in March when security firm Huntress warned about threat actors using OpenClaw, an AI agent platform, as a GitHub lure to deliver the same two payloads2

2

. Zscaler researchers emphasized that this rapid movement to capitalize on buzzy new products and news events increases the chance of opportunistic compromise, especially through trojanized software and deceptive repositories2

2

. The researchers warn that threat actors are already seeding trojanized versions with backdoors, data exfiltration tools, and cryptominers, putting unsuspecting users who clone official-looking forks at immediate risk of compromise1

1

. The malicious archive is updated frequently, suggesting additional payloads may be added in future iterations3

3

. For developers and AI enthusiasts, this incident underscores the critical need for verification before downloading code from repositories, particularly during high-profile AI-related leaks when cybercriminals act quickly to exploit public interest.