GhostSocksMalware
GhostSocks, a Golang-based proxy malware, was first advertised as a Malware-as-a-Service (MaaS) on Russian-speaking underground forums in October 2023. It uses back-connect socket secure internet protocol (SOCKS5) connections and is available for rent for US $100 per month. In February 2024, the author of Lumma Stealer released an update introducing the integration of proxying capabilities.From MISP Galaxy
Last reported 27 days ago, by CERT-EU6 reports
ATT&CK techniques
6 of 21 · each with the sentence it comes from- T1684Social Engineering
“ConclusionThreat actors are actively leveraging the recent Claude Code leak as a social engineering lure to distribute malicious payloads with GitHub serving as a delivery channel.”
- T1036Masquerading
“Utility software provides additional coverage, with lures masquerading asYouTube_Downloader_x64.7z, OrcaSlicer_x64.7z (a 3D printing slicer), iRemovalPro_x64.7z (an iPhone unlocking tool), and perplexity_computer_x64.7z (impersonating the Perplexity AI search assistant).”
- T1055Process Injection
“Process injection and browser hijacking”
- T1176.001Browser Extensions
“…ish approved software repositories, as malware often spreads through fake software installers, cracked applications, and malicious browser extensions downloaded from unofficial sources”
- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“T1027”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
Cyber Brief 26-05 - April 2026“Trojanised Claude Code leak lure distributing Vidar and GhostSocks malware”
-
Claude Code Packaging Error Remains a Lure in an Active Campaign: What Defenders Should Do“Threat actors leveraged Anthropic’s Claude Code npm release packaging error to distribute Vidar, GhostSocks, and PureLog Stealer.”
-
Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads“…try examines how threat actors rapidly weaponized the resulting attention, pivoting an existing AI-themed campaign to spread Vidar and GhostSocks.”
-
Anthropic Claude Code Leak“On execution, the ClaudeCode_x64.exe drops Vidar v18.7 and GhostSocks. Vidar is an information stealer and GhostSocks is used to proxy network traffic.”
-
How Fake OpenClaw Installers Spread GhostSocks Malware“How Fake OpenClaw Installers Spread GhostSocks Malware”
-
Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics“…uced underground visibility, Lumma Stealer remains an active threat with continued endpoint targeting and the documented deployment of GhostSocks as a secondary payload.”
Indicators in its reports
named in the reports above- rti.cargomanbd[.]comin 2 reports
- 147.45.197[.]92in 2 reports
- 94.228.161[.]88in 2 reports
- cli.js[.]mapin 1 report
- snippet[.]hostin 1 report
- hxxps://github[.]com/leaked-claude-code/leaked-claude-codein 1 report
- hxxps://github[.]com/leaked-claude-code/leaked-claude-code/releases/download/leaked-claude-code/Claude_code_x64.7zin 1 report
- socifiapp[.]comin 1 report
- jamelik[.]asiain 1 report
- 516cd47d091622b3…9082395e65e5in 1 report
- pabuloa[.]asiain 1 report
- star-history[.]comin 1 report
- 249058ce8dc6e74c…5dceea008139in 1 report
- 0b6ed577b993fd81…184685af7e05in 1 report
- b73bd2e4cb16e903…896797435b82in 1 report
- e13d9304f7ebdab1…ecfebf18b9fdin 1 report
- 518ff5fbfa4296ab…5175fb70e2b3in 1 report
Copy these 17 indicators · defanged
Thanks — we review every report.