**[Refi Hub Co-Founder Targeted by Malicious Claude Link Attack, Contaminated Skill File Attempts to Steal Credentials]** Odaily Planet Daily News: Numa Lunah, co-founder of the crypto project Refi Hub, revealed that he was targeted by hackers after using a download link provided in the Claude chat window to install a transcription application. The link directed him to a phishing website bundled with malware, which, upon execution, attempted to steal all information from his device. Numa Lunah stated that he cleared and reinstalled the affected laptop and found no evidence of sensitive information leakage. However, he later discovered a contaminated Claude Code skill file named `SKILL.md` in his backup. The file was disguised as a style guide written by him and contained instructions to re-download malware and steal credentials every time it was loaded. Microsoft Defender Experts had previously warned that attackers have shifted from search engine optimization poisoning to poisoning responses from large language models. These methods include recommending download links controlled by attackers, fake AI-branded installation programs, and contaminated code repositories and proxy skills. Crypto industry professionals may possess irrevocable credentials such as seed phrases, private key files, hot wallet JSONs, exchange API keys with withdrawal permissions, and deployment keys. (Source: Bitcoin.com News)