Refi Hub Co-Founder Targeted by Malicious Link Attack from Claude

Refi Hub co-founder Numa Lunah was attacked by hackers after using a download link provided in the Claude chat window to install a transcription application. The link led to a counterfeit website and bundled malware, which attempted to steal all information from his device upon execution. Numa Lunah stated that he cleared and reinstalled the affected laptop and found no sensitive information leaked. Subsequently, he discovered a contaminated Claude Code skill file SKILL.md in his backup, which disguised itself as a style guide he authored and contained instructions to re-download the malware and steal credentials each time it was loaded. Microsoft Defender Experts warned that attackers have shifted from search engine optimization poisoning to large language model response poisoning, employing tactics such as recommending download links controlled by attackers, AI brand impersonation installers, and contaminated code libraries and proxy skills. Cryptocurrency industry practitioners may hold irrevocable credentials such as mnemonic phrases, private key files, hot wallet JSON, exchange API keys with withdrawal permissions, and deployer keys.