Claude Code Leak Sparks GitHub Phishing Frenzy
Hackers Exploit Claude Code Leak in Sophisticated GitHub Scam
Security researchers have uncovered a disturbing trend following the accidental leak of Claude Code's source code. Cybercriminals are now weaponizing developer curiosity through carefully crafted GitHub phishing traps.
The Bait: Too Good to Be True
A user named idbzoomh has flooded GitHub with repositories claiming to offer leaked source code that unlocks premium enterprise features. These fake projects come with convincing descriptions and frequent updates designed to bypass basic security checks.
"The attackers understand their audience perfectly," explains a Zscaler security analyst. "They're preying on developers' natural curiosity about new tools and features."
What makes these traps particularly dangerous:
- Search-engine optimized to appear at the top for "Claude Code leak" queries
- Frequent updates that make them appear legitimate and active
- Enticing promises of unlocking restricted functionality
The Malware Payload: Vidar's Data Heist
When unsuspecting developers download and run the files, they unwittingly install Vidar malware - a notorious information-stealer circulating on dark web markets. This sophisticated threat:
- Harvests credentials from browsers and cryptocurrency wallets
- Deploys GhostSocks proxy tools for covert data exfiltration
- Establishes persistent access for future attacks
The malware operates quietly in the background, often going undetected while it vacuums up sensitive information.
Why This Attack Works So Well
The scheme capitalizes on multiple psychological triggers:
- Curiosity about leaked source code
- FOMO (fear of missing out) on premium features
- Trust in GitHub as a developer platform
SEO manipulation making traps appear legitimate
Security teams have already identified at least two active repositories, suggesting this is just the beginning of a broader campaign.
Protecting Yourself From Similar Scams
The incident highlights several crucial security lessons for developers:
- Always verify sources before downloading executables
- Be skeptical of "too good to be true" offers from unofficial channels
- Keep security software updated to catch emerging threats
- Monitor accounts for unusual activity after accidental exposures
As AI tools become more prevalent, experts warn we'll likely see more attacks targeting developer communities through similar social engineering tactics.
Key Points:
- Hackers created fake GitHub repos offering "leaked" Claude Code features
- The trap installs Vidar malware that steals sensitive information
- Attackers used SEO tricks to boost visibility in search results
- Multiple fake repositories suggest an ongoing campaign
- Developers should only download tools from official sources
