Numa Lunah, co-founder of crypto project Refi Hub, said he was hacked after using a download link shown in Claude's chat window to install a transcription app. The link led to a look-alike website bundled with malware that attempted to steal all data from his device. Lunah said he wiped and reinstalled the laptop and found no evidence that sensitive information had been leaked. Later, he discovered a poisoned Claude Code skill file named SKILL.md in a backup. The file was disguised as a style guide written by Lunah and contained instructions to re-download malware and steal credentials every time it loaded. Microsoft Defender Experts has previously warned that attackers have shifted from search engine optimization poisoning to poisoning large language model answers. Their methods include recommending attacker-controlled download links, AI-branded fake installers, and contaminated code repositories and agent skills. Crypto industry professionals may hold irrevocable credentials such as mnemonic phrases, private key files, hot wallet JSON, exchange API keys with withdrawal permissions, and deployer keys. (Bitcoin.com News)
Numa Lunah, co-founder of crypto project Refi Hub, said he was hacked after using a download link provided in Claude's chat window to install a transcription app. The link led to a look-alike website and was bundled with malware that attempted to collect all information from his device.
Lunah said he wiped and reinstalled the affected laptop and found no signs of sensitive data exposure. Later, he found a tainted Claude Code skill file named SKILL.md in a backup. The file was disguised as a style guide written by Lunah and contained instructions to download malware again and steal credentials every time it loaded.
Microsoft Defender Experts has previously warned that attackers have moved from search engine optimization poisoning to poisoning large language model answers. These tactics include recommending attacker-controlled download links, AI-branded fake installers, and contaminated code repositories and agent skills.
Crypto industry professionals may hold irrevocable credentials such as mnemonic phrases, private key files, hot wallet JSON, exchange API keys with withdrawal permissions, and deployer keys. (Bitcoin.com News)
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
