Threat actors are actively exploiting the recent Claude Code packaging error by hosting fake GitHub repositories that distribute trojanized archives. These archives contain a Rust-compiled dropper that deploys Vidar, GhostSocks, and PureLog Stealer to harvest credentials and establish residential proxies on compromised Windows systems.
GitHub Lure
1 post
Claude Code Packaging Error Remains a Lure in an Active Campaign: What Defenders Should Do