Hackers are spreading the Claude Code leak with malware hidden inside the archives

Cybercriminals have turned the Claude Code data leak into a weapon. Hackers are mass-distributing archives that supposedly contain leaked Anthropic files, but victims also get hidden malware. The attack targets users who go looking for forbidden material and are willing to take risks to get it.

The scheme follows the classic digital bait playbook. Archives with names that hint at exclusive content — an Anthropic leak, internal Claude Code data, source code for the company's products — spread through forums, Telegram channels, Discord servers, and torrents. Alongside real or fabricated files, they hide an infostealer or a loader for additional malware.

Once launched, the malware harvests data from browsers, crypto wallets, and messengers: anything that can be used to hijack accounts or sold on the black market. The attack exploits not only users' curiosity but also their urge to get around restrictions. People hunting for leaked data on commercial AI products often skip standard precautions: they don't verify the source, don't run files in an isolated environment, and don't inspect the contents before opening them.

That makes them a particularly vulnerable audience. Researchers note that schemes like this flare up every time a high-profile leak, real or imagined, hits the public sphere. But this week's hacking attacks weren't limited to Claude Code.

The FBI warned of a serious national security threat: attackers breached lawful phone interception tools, known as wiretap systems. US intelligence and law enforcement agencies use these systems to conduct authorized investigations. Access to them could let attackers obtain classified data on ongoing operations and identify confidential sources.

The FBI did not disclose details of the breach, but stressed that the threat is systemic. At the same time, news broke of a Cisco breach tied to a large-scale supply chain attack campaign. The attackers stole fragments of the company's source code.

That code is highly valuable: it lets attackers hunt for zero-day vulnerabilities, which can then be exploited in targeted attacks on corporate infrastructure worldwide. Supply chain attacks remain one of the most dangerous trends in cybersecurity: a single compromised vendor opens the door to thousands of organizations that trust its products. All three incidents share a common pattern: attackers exploit trust — in brands, in legitimate tools, in partner chains.

When a user downloads a leak archive, they trust their curiosity. When a wiretap system receives a request, it trusts the authorization. When a corporation uses a vendor's software, it trusts the supply chain.

Attackers methodically find and exploit each of these links. For ordinary users, the takeaway is clear: treat any archive with exclusive or leaked content from unofficial sources as potentially malicious, no matter how convincing the description looks. Infostealers hidden in archives like these compromise not just a single device but every service whose password is stored in the browser.

If something looks like a forbidden exclusive, it's most likely a trap.