Attackers Use Claude Code Leak Lure to Deliver Vidar and GhostSocks Malware
Summary
Zscaler says attackers are using trojanized Claude Code repositories on GitHub to distribute Vidar and GhostSocks. The article also describes source code exposed in the public npm package and provides related malware indicators.
Key points
- A 59.8 MB source map bundled with Claude Code version 2.1.88 exposed about 513,000 lines of TypeScript, according to the article.
- The leaked code was mirrored across public GitHub repositories; Anthropic issued DMCA notices against some mirrors.
- Zscaler says attackers are using the leak as a social-engineering lure, with GitHub repositories serving as a delivery channel.
- The malicious payloads identified include Vidar and GhostSocks, as well as downloader and dropper files.
- The article provides file hashes, command-and-control indicators, and links to repositories it identifies as trojanized.
- Zscaler says its Advanced Threat Protection covers the identified threats.
Article Details
- Event Type
- Exposure of Claude Code source code through a public npm package, followed by social-engineering lures distributing malware via trojanized repositories.
- Impact
- The leak exposed approximately 513,000 lines of source code. The article reports widespread copying and redistribution, and warns of opportunistic compromise through trojanized repositories and possible vulnerability-exploit attempts against legitimate Claude agents.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 3388b415610f4ae018d124ea4dc99189 | Hash identified as GhostSocks. |
| MD5 | 77c73bd5e7625b7f691bc00a1b561a0f | Hash of a dropper EXE file for the payload. |
| MD5 | 81fb210ba148fd39e999ee9cdc085dfc | Hash of a dropper EXE file for the payload. |
| MD5 | 8660646bbc6bb7dc8f59a764e25fe1fd | Hash of the initial archive file. |
| MD5 | 9a6ea91491ccb1068b0592402029527f | Hash identified as Vidar v18.7. |
| MD5 | d8256fbc62e85dae85eb8d4b49613774 | Hash of the initial archive file. |
| URL | hxxps[:]//147[.]45[.]197[.]92 | GhostSocks command-and-control URL. |
| URL | hxxps[:]//94[.]228[.]161[.]88 | GhostSocks command-and-control URL. |
| URL | hxxps[:]//github[.]com/idbzoomh1 | GitHub profile identified as a publisher of a trojanized repository. |
| URL | hxxps[:]//github[.]com/leaked-claude-code/leaked-claude-code | URL identified as a trojanized Claude Code source leak repository. |
| URL | hxxps[:]//github[.]com/my3jie/leaked-claude-code | URL identified as a trojanized Claude Code source leak repository. |
| URL | hxxps[:]//rti[.]cargomanbd[.]com | Vidar command-and-control URL. |
| URL | hxxps[:]//steamcommunity[.]com/profiles/76561198721263282 | Vidar Dead Drop Resolver (DDR) URL. |
| URL | hxxps[:]//telegram[.]me/g1n3sss | Vidar Dead Drop Resolver (DDR) URL. |
People
Malware
GhostSocksIn addition to discussing the Anthropic leak, this blog post also covers a “Claude Code leak” lure delivering Vidar and Ghostsocks malware that was discovered and analyzed by the Zscaler ThreatLabz team.TradeDownloaderWin64.Downloader.TradeDownloaderVidarIn addition to discussing the Anthropic leak, this blog post also covers a “Claude Code leak” lure delivering Vidar and Ghostsocks malware that was discovered and analyzed by the Zscaler ThreatLabz team.
Vendors
AnthropicCRITICAL ALERT: Anthropic's Claude source code leaked via npm, and threat actors are ZscalerIn addition to discussing the Anthropic leak, this blog post also covers a “Claude Code leak” lure delivering Vidar and Ghostsocks malware that was discovered and analyzed by the Zscaler ThreatLabz team.