Refi Hub Co-Founder Says Claude Download Link Led to Malware Attack

Refi Hub co-founder Numa Lunah said he was hacked after installing a transcription app through a download link provided in a Claude chat window. According to Odaily, the link led to a spoofed website bundled with malware that tried to steal all information on his device. Lunah said he wiped and reinstalled the laptop involved and found no evidence that sensitive information had been leaked. He later found a compromised Claude Code skill file, SKILL.md, in his backups. The file was disguised as a style guide he had written and included instructions to redownload malware each time it loaded and steal credentials. Microsoft Defender Experts previously warned that attackers have shifted from search engine optimization poisoning to poisoning large language model responses. The tactics include recommending attacker-controlled download links, fake AI-branded installers, and compromised code repositories and agent skills. Crypto industry workers may hold irreversible credentials such as seed phrases, private key files, hot wallet JSON files, exchange API keys with withdrawal permissions, and deployer keys.