Indicators of Compromise

144.31.123.157

ThreatFox: GhostSocks

7942f7097e151f90cb5c9f579042c36133e93306

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

b4554c85f50c56d550d6c572a864deb0442404ddefe05ff27facb3cbfb90b4d6

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

d8256fbc62e85dae85eb8d4b49613774

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

7798feb26b98bb11f758d68e10fed0e0d7c78881

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

06f63fe3eba5a2d1e2177d49f25721c2bdd90f3c46f19e29740899fa908453bf

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

7d5e84dd59165422f31a5a0e53aabba657a6fbccc304e8649f72d49e468ae91a

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

3388b415610f4ae018d124ea4dc99189

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

81fb210ba148fd39e999ee9cdc085dfc

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

8660646bbc6bb7dc8f59a764e25fe1fd

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

9a6ea91491ccb1068b0592402029527f

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

https://rti.cargomanbd.com

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

4c3b9af7995072965e763fca0e472f00b84a8aea

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

afa34c71a45f21d599c0bd90ac9026f68727aab0019c3b378956401475180c9c

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

dff9ea007c0b24d35fd7393313c64a4b42ed1109

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

77c73bd5e7625b7f691bc00a1b561a0f

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

https://147.45.197.92:443

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

https://94.228.161.88:443

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

rti.cargomanbd.com

Threat Actors Leverage Claude Code Leak as Social Engineering Lure to Distribute Malicious Payloads via GitHub

144.31.204.145

ThreatFox: GhostSocks

144.31.204.136

ThreatFox: GhostSocks

64.188.70.194

ThreatFox: GhostSocks

94.228.161.88

ThreatFox: GhostSocks

77.110.117.204

ThreatFox: GhostSocks

84.201.4.120

ThreatFox: GhostSocks

172.245.112.202

ThreatFox: GhostSocks

206.245.157.177

ThreatFox: GhostSocks

193.23.211.29

ThreatFox: GhostSocks

77.239.121.3

ThreatFox: GhostSocks

77.239.120.249

ThreatFox: GhostSocks

93.185.159.90

ThreatFox: GhostSocks

77.110.117.211

ThreatFox: GhostSocks

144.31.139.203

ThreatFox: GhostSocks

144.31.139.201

ThreatFox: GhostSocks

147.45.197.92

ThreatFox: GhostSocks

ddd2994acd25bde5ac32a03f1cf30b41

Phantom Footprints: Tracking GhostSocks Malware

10f928e00a1ed0181992a1e4771673566a02f4e3

Phantom Footprints: Tracking GhostSocks Malware

3d9d7a7905e46a3e39a45405cb010c1baa735f9e

Phantom Footprints: Tracking GhostSocks Malware

9b90c62299d4bed2e0752e2e1fc777ac50308534

Phantom Footprints: Tracking GhostSocks Malware

59312a8d6663c9a404d0b5aa96b70be3946592e5c5489366e04114b11a722fa1

Phantom Footprints: Tracking GhostSocks Malware

fab6525bf6e77249b74736cb74501a9491109dc7950688b3ae898354eb920413

Phantom Footprints: Tracking GhostSocks Malware

retreaw.click

Phantom Footprints: Tracking GhostSocks Malware

ddd2994acd25bde5ac32a03f1cf30b41

Phantom Footprints: Tracking GhostSocks Malware

www.lbfs.site

Phantom Footprints: Tracking GhostSocks Malware

w2.bruggebogeyed.site

Phantom Footprints: Tracking GhostSocks Malware

10f928e00a1ed0181992a1e4771673566a02f4e3

Phantom Footprints: Tracking GhostSocks Malware

3d9d7a7905e46a3e39a45405cb010c1baa735f9e

Phantom Footprints: Tracking GhostSocks Malware

9b90c62299d4bed2e0752e2e1fc777ac50308534

Phantom Footprints: Tracking GhostSocks Malware

59312a8d6663c9a404d0b5aa96b70be3946592e5c5489366e04114b11a722fa1

Phantom Footprints: Tracking GhostSocks Malware

fab6525bf6e77249b74736cb74501a9491109dc7950688b3ae898354eb920413

Phantom Footprints: Tracking GhostSocks Malware