Hackers Exploit Claude Code Leak in Sophisticated GitHub Phishing Scheme
Claude Code Source Code Leak Sparks Developer Security Crisis
A human error at Anthropic has turned into a hacker's goldmine, with over 513,000 lines of front-end source code for the Claude Code AI tool accidentally exposed online. Within days, cybercriminals launched an elaborate phishing campaign targeting curious developers.
The GitHub Trap
Security analysts have identified multiple fake repositories popping up on GitHub, all promising exclusive access to the leaked code. One particularly active account, idbzoomh, has been luring developers with promises of "unlocked enterprise features" and "complete leaked versions."
"These aren't your average phishing attempts," explains cybersecurity researcher Mark Chen. "The attackers have gone to extraordinary lengths to make their repositories appear legitimate, even optimizing them to rank high in search results for related queries."
The Vidar Threat
The bait comes with a dangerous hook: any downloaded files secretly install Vidar malware. This sophisticated trojan specializes in:
- Stealing browser credentials and session cookies
- Harvesting cryptocurrency wallet information
- Capturing sensitive system credentials
- Installing additional payloads through proxy tools like GhostSocks
What makes this campaign particularly concerning is how quickly the attackers adapt. Security teams report seeing repository updates sometimes multiple times per day as hackers test new distribution strategies.
Protecting Yourself
Anthropic has issued urgent warnings advising developers to:
- Only download tools from official company channels
- Verify repository ownership before cloning or downloading
- Be extremely wary of any "leaked" or "cracked" versions
- Keep security software updated with the latest threat definitions
The company is working with GitHub to take down fraudulent repositories, but new ones appear as quickly as old ones get removed.
Key Points:
- Massive Exposure: Over 500k lines of Claude Code source code accidentally leaked
- Sophisticated Lure: Hackers created convincing fake GitHub repositories
- Dangerous Payload: Downloads install Vidar trojan that steals sensitive data
- SEO Trickery: Malicious repos optimized to appear in top search results
- Ongoing Threat: Attackers continuously update their methods and distribution channels
