Fake Claude Code Downloads Deliver Vidar Stealer and GhostSocks Malware
Summary
Trend Micro reports that attackers used fake GitHub repositories and trojanized 7z downloads, exploiting interest in Anthropic’s leaked Claude Code source to distribute a dropper that installs Vidar stealer and GhostSocks.
Key points
- Attackers repurposed an existing rotating-lure campaign to impersonate leaked Claude Code downloads within 24 hours of the source exposure.
- The campaign used newly created GitHub repositories and 7z archives to deliver a Rust-compiled dropper, often named TradeAI.exe or ClaudeCode_x64.exe.
- The dropper installs Vidar, which steals browser credentials, cryptocurrency wallets, session tokens, and system information, alongside GhostSocks, which turns infected devices into SOCKS5 proxies.
- The malware uses Steam and Telegram profiles as dead-drop resolvers for command-and-control addresses and includes extensive sandbox and analysis-tool checks.
- Its embedded PowerShell payload can add Windows Defender exclusions, disable several protections, and open inbound firewall ports.
- Anthropic attributed the source exposure to an npm packaging error, removed the affected package version, and said customer data and credentials were not exposed.
- The article recommends installing developer tools only from verified sources, scrutinizing new GitHub Release repositories, blocking known infrastructure, and monitoring for infostealer activity.
Article Details
- Attack Vectors
- Operators used fake GitHub repositories, search-result visibility, and README claims about leaked source or unlocked features to lure users into downloading trojanized 7z release archives.
- The archives delivered a Rust-compiled dropper, TradeAI.exe, which deploys Vidar Stealer and GhostSocks.
- Vidar steals browser credentials, cryptocurrency wallets, session tokens, and system information; GhostSocks tunnels traffic through compromised machines as SOCKS5 proxies.
- The dropper uses sandbox and analysis-environment checks, encrypted strings, and an embedded encoded PowerShell payload that disables Windows Defender protections and opens inbound firewall ports.
- Vidar resolves active C2 infrastructure through Steam Community and Telegram dead-drop resolvers, then sends stolen data to its C2 server.
- Defensive Notes
- Use verified software sources and approved installation channels; treat unofficial GitHub repositories offering standalone installers as potentially malicious.
- Scrutinize GitHub Releases, especially large archives on newly created repositories with minimal commit history, and maintain an allowlist of approved AI-tool sources.
- Block known campaign infrastructure and monitor for credential theft, connections to the cited Steam and Telegram dead-drop resolvers, and unusual SOCKS5 proxy activity.
- Use endpoint detections for Vidar variants and Rust-compiled droppers; the article notes that anti-sandbox behavior makes static detection rules important.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | rti[.]cargomanbd[.]com | Destination domain cited in a hunting query for Vidar C2 connections. |
MITRE ATT&CK
T1005 · Data from Local SystemVidar collects local cryptocurrency wallets and session tokens.T1027 · Obfuscated Files or InformationThe dropper conceals strings with XOR encryption and stores an XOR-encoded, Base64-encoded PowerShell payload.T1041 · Exfiltration Over C2 ChannelStolen data is sent to the Vidar C2 server.T1090.003 · Multi-hop ProxyGhostSocks provides SOCKS5 proxying through compromised victim machines.T1102.001 · Dead Drop ResolverVidar uses a Steam Community profile and a Telegram channel as dead-drop resolvers for its active C2 address.T1204.002 · Malicious FileThe infection chain requires the victim to execute the downloaded dropper.T1497.001 · System ChecksThe dropper checks for virtual machines, sandbox artifacts, and analysis environments before proceeding.T1555 · Credentials from Password StoresVidar steals browser credentials from the victim.T1566.002 · Spearphishing LinkLure repositories used download links to direct victims to trojanized archives.T1585.003 · Cloud AccountsOperators used disposable GitHub accounts to distribute the lures.T1608.001 · Upload MalwareCampaign malware was hosted as assets on GitHub Releases.
Malware
GhostSocksearlier this year abused fake AI tooling repositories to distribute Vidar‑class infostealers and GhostSocks proxy malware, as previously documented by Huntress. Our observation reveals that it’s likely that theTradeAI.exeTradeAI.exeVidar Similar GitHub‑hosted lure campaigns earlier this year abused fake AI tooling repositories to distribute Vidar‑class infostealers and GhostSocks proxy malware, as previously documented by Huntress. Our observation
Vendors
Products
Claude CodeIn late March 2026, Anthropic inadvertently released the internal Claude Code source material as part of an npm package that included a large internal source map file. Although the incident stemmed from a simpleGitHubto capitalize on the resulting attention. Only 24 hours after the leak, they were able to create fake GitHub repositories to distribute credential-stealing malware disguised as “leaked” Claude Code downloads.npmIn late March 2026, Anthropic inadvertently released the internal Claude Code source material as part of an npm package that included a large internal source map file. Although the incident stemmed from a simple
Industries
Creative and mediaCreative and media tools round out the lure portfolio. The operators impersonate voice modification software (voicemod_x64.7z), AI video generation tools (seedance_x64.7z, LTX-2.3_x64.7z, SoraRemover_x64.7z), and imageCryptocurrencyCryptocurrency and trading tools form the second major theme. Archives named hyperliquid-bot_x64.7z and bbg_free_x64.7z (mimicking Bloomberg Terminal) target the finance and crypto community, which is a demographic withfinanceArchives named hyperliquid-bot_x64.7z and bbg_free_x64.7z (mimicking Bloomberg Terminal) target the finance and crypto community, which is a demographic with high-value credentials and wallet data that makes them