I don't have the capability to verify at the moment. But I suspect that a case I worked recently was related. A YouTube video was pointing people at a supposed plugin to make Claude free forever. The plugin was actually a Remote Access Trojan (RAT) and credential stealer. The initial loader was hosted on GitHub. The profile was fairly new and only had a couple updates, mostly adding the Trojan and README files.
post
4 comments in c/cybersecurity@sh.itjust.works view that post
I discussed with an AI what else could be done about this, but it didn’t offer any useful advice.
Could have skipped this part.
replies:
1 comment in c/cybersecurity@infosec.pub view that post
[removed by mod]
permalink
fedilink
source
hideshow 1 child comment
1 comment