Threat actors exploited Anthropic’s Claude Code npm release packaging error to host malicious GitHub releases that distributed Vidar, GhostSocks, and PureLog Stealer via trojanized archives and a Rust-compiled dropper. TrendAI Research tracked the campaign to the repository github[.]com/leaked-claude-code/leaked-claude-code (GitHub account idbzoomh1), published detection guidance, IOCs, and immediate mitigation steps including endpoint scans, credential rotation, and blocking identified C2 domains. #Vidar #GhostSocks #PureLog #Anthropic #ClaudeCode #idbzoomh1
Keypoints
- Threat actors leveraged a packaging error tied to Anthropic’s Claude Code to create malicious GitHub releases that served as the distribution hub for multiple information stealers.
- Observed payloads included Vidar, GhostSocks, and PureLog Stealer, enabling browser credential theft, cryptocurrency wallet exfiltration, session hijacking, and SOCKS5 proxy creation on Windows hosts.
- Campaign distribution was centered on the repository https://github[.]com/leaked-claude-code/leaked-claude-code operated by GitHub account idbzoomh1, with the active download URL containing Claude_code_x64.7z.
- TrendAI detections and protections (patterns, behavioral detections, web reputation blocks, and hunting queries) identify the malware components and block associated C2 infrastructure and malicious GitHub assets.
- Recommended mitigations include searching endpoints for extracted executables (e.g., TradeAI.exe, ClaudeCode_x64.exe), running updated endpoint scans, rotating all credentials, and blocking C2 domains and raw paste/snippet URLs at the network perimeter.
- The campaign cycles through many brand lures (25+ software brands observed) and uses trojanized archives with a Rust dropper to deliver multi-stage, fileless loaders and stealers; download counts and repository engagement indicate ongoing exposure risk.
MITRE Techniques
- [T1105] Ingress Tool Transfer – Used to deliver malware via GitHub release assets: ‘deliver payloads via a release asset.’
- [T1566] Phishing (Social Engineering) – The campaign used social engineering lures and urgency tied to the Claude Code leak to entice downloads: ‘social engineering techniques that prey on alarm and urgency.’
- [T1555.003] Credentials from Web Browsers – Malware components harvest browser-stored credentials and session tokens: ‘harvest Chrome credentials, browser extensions, cryptocurrency wallets, and system information.’
- [T1090] Proxy – GhostSocks establishes a SOCKS5 proxy on infected hosts to tunnel traffic and enable residential proxy abuse: ‘establish a SOCKS5 proxy on the victim’s machine.’
- [T1055] Process Injection – Detection rules reference process injection behavior used by the malware: ‘Detects process injection behavior.’
- [T1059.001] Command and Scripting Interpreter: PowerShell – The dropper and components may spawn encoded PowerShell, detected/blocked by protections: ‘Prevents spawning of encoded PowerShell.’
- [T1547] Boot or Logon Autostart Execution – Malware persistence observed via autorun-style behavior: ‘Detects non-whitelisted processes that exhibit self-propagation and persistence via autorun.’
- [T1071.001] Application Layer Protocol: Web Protocols – C2 and malware accomplice activity observed and blocked via web reputation: ‘URL Access Blocked – C&C Server.’
- [T1218] Signed Binary Proxy Execution / Fileless Techniques – The campaign uses multi-stage fileless loader chains executing in memory to evade detection: ‘executes entirely in memory using a multi-stage fileless loader chain to evade detection.’
Indicators of Compromise
- [Email ] Threat actor contact – [email protected]
- [GitHub account ] distribution operator – idbzoomh1 (previous account idbzoomh was blocked)
- [Repository / Release URL ] malicious distribution hub – https://github[.]com/leaked-claude-code/leaked-claude-code, hxxps[:]//github[.]com/leaked-claude-code/leaked-claude-code/releases/download/leaked-claude-code/Claude_code_x64[.]7z
- [Filenames / Payloads ] dropped archive and executables – Claude_code_x64.7z, ClaudeCode_x64.7z, Claude-Code_x64.7z, TradeAI.exe, ClaudeCode_x64.exe
- [Domains / C2 ] command-and-control and accomplice hosts to block – rti[.]cargomanbd[.]com, pastebin[.]com/raw/mcwWi1Ue, snippet[.]host/efguhk/raw
- [Network ports ] proxy/backdoor communication – TCP 57001, TCP 57002, TCP 56001 (used by GhostSocks-created firewall rules)