Hackers Distribute Malware via Counterfeit Anthropic Claude Code Repositories

Exploitation of Anthropic Leak

Cybercriminals are currently targeting developers by distributing malicious software disguised as Anthropic's new AI tool, Claude Code. This campaign follows a recent accidental leak of the tool's source code by an Anthropic employee. Attackers are now uploading fraudulent repositories to GitHub that claim to offer the leaked software but instead contain data-stealing scripts.

The scam relies on the high demand for Claude Code, a command-line interface designed to automate programming tasks. Developers seeking early or unauthorized access to the tool are frequently bypassing standard security protocols. This behavior provides a direct entry point for hackers to compromise professional workstations and corporate networks.

Mechanics of the GitHub Attack

Security researchers have identified several tactics used to make these fake repositories appear legitimate. Threat actors use bot accounts to inflate star counts and fork numbers, creating a false sense of community trust. The malicious payload is typically hidden within installation scripts or disguised as necessary dependencies.

• Attackers use SEO poisoning to rank their GitHub pages in search results.
• Installation commands often include obfuscated Python or JavaScript code.
• The malware focuses on extracting environment variables, SSH keys, and browser credentials.
• Once executed, the scripts establish persistence on the host machine to monitor future activity.

Risks to Development Teams

The primary danger lies in the elevated permissions many developers maintain on their local machines. If a developer runs a compromised version of Claude Code, the malware gains access to private repositories and cloud infrastructure keys. This can lead to supply chain attacks where the hacker injects code into the victim's own software products.

Anthropic has since secured the original leak, but the mirrored versions continue to circulate on decentralized platforms and code-sharing sites. Security teams are advising engineers to only download tools from official verified sources and to verify checksums before execution. Relying on unauthorized mirrors of proprietary AI software remains a high-risk activity for any organization.

Security firms are now monitoring GitHub for new clusters of automated accounts spreading these specific AI-themed payloads.