Refi Hub Co-Founder Targeted by Malicious Link Attack from Claude

Refi Hub co-founder Numa Lunah was attacked by hackers after using a download link provided in the Claude chat window to install a transcription application. The link led to a counterfeit website and bundled malware, which attempted to steal all information from his device upon execution. Numa Lunah stated that he cleared and reinstalled the affected laptop and found no sensitive information leaked. Subsequently, he discovered a contaminated Claude Code skill file SKILL.md in his backup, which disguised itself as a style guide he authored and contained instructions to re-download the malware and steal credentials each time it was loaded. Microsoft Defender Experts warned that attackers have shifted from search engine optimization poisoning to large language model response poisoning, employing tactics such as recommending download links controlled by attackers, AI brand impersonation installers, and contaminated code libraries and proxy skills. Cryptocurrency industry practitioners may hold irrevocable credentials such as mnemonic phrases, private key files, hot wallet JSON, exchange API keys with withdrawal permissions, and deployer keys.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.