Trend MicroPublished
Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads
Excerpt
Key takeaways
Anthropic inadvertently exposed internal Claude Code source material via a misconfigured npm package, which included approximately 512,000 lines of internal TypeScript and triggering rapid mirroring across GitHub.
Within 24 hours, threat actors took advantage of the attention around the leak, to distribute Vidar stealer and GhostSocks proxy malware through fake “leaked Claude Code” GitHub repositories.
The Claude Code bait is part of a broader rotating lure operation active since February 2026, impersonating more than 25 software brands while delivering the same Rust-compiled infostealer payload.
The campaign abuses GitHub Releases as a…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Trend Micro on trendmicro.com.
Mentioned in the excerpt
More from Trend Micro18
- Lemon Group’s Cybercriminal Businesses Built on Preinfected DevicesTrend Micro · Published 17 May 2023
- Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures RevealedTrend Micro · Added 14 Oct
- Prompting the Payload: How an npm Supply Chain Attack Delivers the RedC2 AI-Powered Linux ImplantTrend Micro · Added 2 Sep
- Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential TheftTrend Micro · Published 13 May
On the same topics
- Vidar v1.5 in Go: same family, new language, heavy sandbox checksderp.ca · Published 16 May
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub RepositoriesThe Hacker News · Published 19 Oct
