TLDR Tech / InfoSec
Fake Claude Code source downloads actually delivered malware
According to Zscaler's ThreatLabz, a GitHub repository from user idbzoomh surfaced as a top Google search result for "leaked Claude Code," masquerading as a leaked TypeScript source for Anthropic's CLI. However, the available .7z downloads actually contained a Rust-based dropper that deployed Vidar v18.7 to harvest browser history, credit card information, and credentials. The infection also included GhostSocks, a tool that repurposes compromised systems into proxy nodes.
Read the full story