Hackers are exploiting the recent leak of Claude Code source code by distributing Vidar malware through fake GitHub repositories. The breach, caused by an Anthropic human error, has led to the creation of repositories falsely claiming to offer "enterprise-level features" of the leaked code. Cybersecurity firm Zscaler reports that a user named idbzoomh is behind multiple malicious repositories, which have been optimized for search engines to appear prominently in search results. The Vidar malware, embedded in these repositories, is designed to steal sensitive information such as browser credentials and cryptocurrency wallets. It also uses the GhostSocks proxy tool for remote control and data exfiltration. Security experts warn developers to avoid downloading binaries from unofficial sources and to rely on official channels to prevent falling victim to these phishing attacks.