Hackers Impersonate Anthropic's Claude Code to Spread Vidar Stealer as APT28 Targets Routers

Anthropic's Claude Code is an AI coding tool for developers, but hackers are exploiting its name to distribute the Vidar information stealer in an effort to obtain credentials and sensitive data. The incidents also involve network-device attacks by the Russian hacking group APT28 and a European Commission data breach linked to a compromise of the Trivy supply chain, highlighting the intertwined risks of brand impersonation, router vulnerabilities and open-source tools.

An April 8 cybersecurity report disclosed that APT28 had hijacked SOHO routers on a large scale, using DNS hijacking to redirect victims to attacker-controlled adversary-in-the-middle, or AiTM, infrastructure. Separately, a user was infected with Vidar after downloading a file posing as Claude Code. The European Commission also confirmed that its data breach was linked to the Trivy supply-chain attack. Current disclosures have not specified the number of affected devices, the scale of the leak or the financial losses.