Fake Claude Code GitHub Releases Deliver Vidar, GhostSocks and PureLog Malware

Summary

Trend Micro reports that attackers used fake GitHub releases exploiting attention around a Claude Code packaging error to distribute Vidar, GhostSocks and PureLog Stealer. It offers detection guidance and recommendations to reduce exposure.

Key points

A GitHub account used the Claude Code packaging error as a lure, distributing malware through fake repositories and release archives.
The campaign delivered Vidar, GhostSocks and PureLog Stealer, targeting Windows systems.
The malware can steal browser credentials, cryptocurrency wallets and session tokens; GhostSocks can turn infected systems into SOCKS5 proxies.
Trend Micro says the activity is part of a broader campaign active since February 2026 that has used more than 25 software brands.
Defenders can hunt for the listed suspicious execution, download and malware indicators using endpoint alerts and threat-hunting queries.
Recommended precautions include securing developer workstations, inspecting shared code, using isolated development environments and rotating developer credentials.

Article Details

Defense Focus: Detect and block the distribution and execution of malware using the Claude Code packaging error as a lure, and investigate potential exposure.
Detection Methods: Use the provided Search App queries to detect VIDAR or GHOSTSOCKS malware detections and Vidar C&C communication.
Review Observed Attack Techniques and Workbench alerts for suspicious execution of a possible leaked Claude Code binary, related file downloads, and URL access detections.
Use pattern updates, behavioral detections, web reputation, and machine-learning detections to identify campaign components and activity.
Monitor for suspicious PowerShell spawning, process injection, self-propagation, and persistence via autorun.
Hunt for network egress and direct proxy abuse associated with GhostSocks.
Data Sources: Endpoint and server protection detections
Workbench security alerts
Search App event data, including malware detections and destination addresses
Web reputation and URL access events
Developer workstation activity and network egress
Rule Types: TrendAI Observed Attack Techniques detections
TrendAI pattern, behavioral, predictive machine-learning, and signature detections
TrendAI Web Reputation Service URL blocks
TrendAI Vision One Search App hunting queries using malware-name and event-name filters, and event-sub-ID and destination filters
Platforms: Windows
Defensive Actions: Secure developer workstations with EDR and behavioral protection, and log source code, intellectual property, cloud tokens, API keys, and GitHub credentials.
Apply zero-trust practices to shared or downloaded code; inspect developer ranking and history before downloading, and monitor developer network access.
Use VM-based development environments and non-privileged containers, and monitor developer access to networks, credentials, and keys.
Restrict development to licensed, approved tools and applications.
Rotate browser tokens, GitHub credentials, cloud API keys, and local configuration credentials; keep them short-lived.
Use TrendAI Vision One protections and available hunting queries to investigate potential exposure.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`rti[.]cargomanbd[.]com`	Destination identified in the article's hunting query for Vidar C&C communication.
EMAIL	`blactethe1061@outlook[.]com`	Listed as a threat actor email identifier.
URL	`hxxps[:]//github[.]com/leaked-claude-code/leaked-claude-code/releases/download/leaked-claude-code/Claude_code_x64[.]7z`	Current release-asset URL identified as the malicious campaign payload download.