Claude Code leak used to push infostealer malware on GitHub

Threat actors exploited Anthropic's accidental Claude Code source-code leak by publishing SEO-optimized fake GitHub repositories purporting to host the leaked files; downloads contained a Rust dropper (ClaudeCode_x64.exe) that installs the Vidar info-stealer and GhostSocks proxy. Zscaler researchers observed frequent updates to the malicious archive and multiple repositories likely operated by the same actor, indicating an active campaign that targets curious users searching for the leak.