Refi Hub Co-Founder Says a Claude Chat Link Led to a Malware Attack

On Friday a hacking story raced across X. The account came from Numa Lunah, a co-founder of the Solana-based startup Refi Hub, and describes pasting an install command that surfaced inside a Claude chat window, watching it turn out to be malware from a copycat download site, then discovering during recovery that one of the agent configuration files in the backup had been quietly weaponized. Santage has not independently verified every detail, and Anthropic has not commented, though the core of the account matches attacks that named security firms have already documented. The thread passed 865,000 views in a day because it put a human face on a threat researchers have been measuring all year.

What Numa Lunah says happened

The account describes two separate failures. First, while installing a transcription app, Lunah says a Claude chat produced a download link and a terminal command that looked legitimate but pointed to a copycat site bundling malware, which ran the moment it was executed. Second, and more unsettling, while restoring from a backup he says he found a SKILL.md file for Claude Code formatted to look like his own writing-style guide, but carrying buried instructions to silently re-download the malware and steal credentials every time the assistant loaded it. What saved the machine, by his account, was a habit: reading every skill, hook, and config file before letting the AI touch it.

Why researchers were not surprised

Strip away the personal detail and the thread describes two attack classes that security teams have been cataloguing since the start of the year. The first is the agent skill file as a delivery mechanism. Skills, the reusable capability packages that extend Claude Code, Cursor, and similar agents, are plain text that the model reads and then acts on. That is exactly what makes them dangerous. In February, Snyk published a study of ClawHub, one of the largest public skill repositories, and found that 1,467 of the 3,984 skills it scanned, about 36 percent, carried at least one security flaw. Roughly one in eight had a critical issue.

A benign skill, a hidden payload

The most direct proof that Lunah's scenario is plausible came months earlier. In December, researchers at Cato Networks took one of Anthropic's own legitimate skills, a GIF creator, and added a helper function that looked like a harmless post-processing step. Hidden inside, it silently fetched an external script and ran MedusaLocker ransomware, all under the single approval the user had already granted the skill. There was no second prompt and no visible warning.

The trust gap Cato exploited is the same one the viral thread describes. A user approves a skill or an agent file once, sees only the layer of it that looks reasonable, and never inspects what the model actually executes when it loads the file later.

The link you did not vet

The other half of the thread, the bad install command, has its own research literature. AI assistants routinely suggest software packages and download commands that were never verified, and sometimes never existed. One study across 30 AI systems examined 2.23 million package references generated from 576,000 code samples and found that 19.7 percent were hallucinated, names the model simply invented. Attackers have learned to register those invented names and fill them with malware, a tactic now called slopsquatting. The Claude-specific version is already in the wild. In March, Kaspersky documented a malvertising campaign that planted fake Claude Code and OpenClaw download sites at the top of search results, mimicking the real Anthropic and OpenAI pages and pushing the Amatera and AMOS infostealers to anyone who pasted the install command into a terminal, which is the same trap the Refi Hub account describes.

Source: Snyk, Cato Networks, and Kaspersky research, 2025 to 2026.

What actually protects you

The defenses are unglamorous and they work. Treat every agent file as executable code, because it is, and read skills, hooks, and configs before an agent loads them, especially anything restored from a backup or pulled from a public registry. Never paste an install command from a chat window without confirming the package name and the source domain yourself. Prefer official registries and signed releases over raw links, and keep agent permissions scoped so that one approval cannot silently become file access, network access, and credential access at once.

Lunah's account may or may not have happened in every detail as told. It almost does not matter. Snyk's scanners, Cato's proof of concept, and a year of supply-chain research all point at the same soft spot, the moment a person trusts a file or a link because an AI presented it politely. The agents are only going to hand us more of both. The habit that saved one laptop, reading before running, is quietly becoming a core security skill for everyone who works with them.

Note on sourcing: the first-person account described here was posted publicly by Numa Lunah and reported by crypto-industry press; Santage has not independently verified every detail. The attack techniques it describes are documented by the security research cited above. Anthropic had not commented at the time of publication.