Fake Claude Code GitHub Repos Spread Vidar Infostealer and GhostSocks

Threat actors used fake GitHub repositories themed around Anthropic's leaked Claude Code source to distribute malware to users searching for the exposed codebase. Researchers at Zscaler ThreatLabz said one repository, operated by user idbzoomh, promoted a supposed Claude Code leak with "unlocked enterprise features" and no restrictions, while search-engine optimization helped it rank for queries such as "leaked Claude Code." Victims who downloaded the offered archive received a Rust-based executable, ClaudeCode_x64.exe, instead of source code.

The executable acted as a dropper for the Vidar information stealer and the GhostSocks proxy malware. The lure followed Anthropic's accidental exposure of a 59.8 MB JavaScript source map in an npm package, which revealed roughly 513,000 lines of unobfuscated TypeScript across 1,906 files and exposed internal logic and security-related details. Zscaler also identified a second similar repository believed to be tied to the same actor, indicating an ongoing campaign that reportedly reached tens of thousands of users and mirrors recent malware delivery efforts built around fake developer-tool downloads.