Claude Code Leak Exploited to Spread Vidar and GhostSocks via GitHub Releases

Hackers have turned Anthropic’s accidental Claude Code source leak into a distribution vector for malware: malicious GitHub Releases offering “leaked” Claude Code archives contain Rust loaders that drop the Vidar stealer and GhostSocks SOCKS5 proxy, enabling credential and cryptocurrency theft and conversion of infected hosts into proxy infrastructure; attackers rotate disposable repositories and evade takedowns. The publicly exposed 512k‑line codebase also raises agentic risk by revealing internal agent scaffolding and safety logic that could be mined for prompt‑injection, privilege escalation, or other targeted attacks.