Malware
GhostSocks
- First Reported
- Mar 20, 2025
- Latest Reported
- May 7, 2026
Reported Context (5)
- Huntress documented the first in February 2026: fake OpenClaw installer, Vidar, and PureLogs, and GhostSocks SOCKS5 proxy, delivered via Telegram dead-drop C2 resolution1. Fake OpenClaw Installers Deliver Rust Malware Targeting Crypto Wallets and Password Managers
- Threat actors leveraged Anthropic’s Claude Code npm release packaging error to distribute Vidar, GhostSocks, and PureLog Stealer. Fake Claude Code GitHub Releases Deliver Vidar, GhostSocks and PureLog Malware
- earlier this year abused fake AI tooling repositories to distribute Vidar‑class infostealers and GhostSocks proxy malware, as previously documented by Huntress. Our observation reveals that it’s likely that the Fake Claude Code Downloads Deliver Vidar Stealer and GhostSocks Malware
- In addition to discussing the Anthropic leak, this blog post also covers a “Claude Code leak” lure delivering Vidar and Ghostsocks malware that was discovered and analyzed by the Zscaler ThreatLabz team. Attackers Use Claude Code Leak Lure to Deliver Vidar and GhostSocks Malware
- Tracking GhostSocks Proxies Hunt.io Adds IOC Feed and Threat-Actor Attribution to C2 Data
Malware (12)
People (3)
Threat Actors (1)
MITRE ATT&CK (21)
Vendors (7)
Products (16)
Tools (2)
Industries (3)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.