News

Claude has gone offline on the day after its maker Anthropic filed for what is expected to be a blockbuster IPO. The popular chatbot and coding tool suffered an outage from around 0600 UTC on Tuesday, with Anthropic saying the team was investigating the issue. By 1042 UTC, the status page said a fix had been implemented and the technical team was monitoring the results. Some users continued to complain to The Register about the disruption after that point. Downdetector shows users reporting the LLM service from Anthropic was down twice momentarily yesterday. A surge in reports started from 0700 UTC today and peaked at 0948 UTC, after which they started to fall. The timing of the technical difficulties is unfortunate for Anthropic, the company founded in 2021 by former employees of OpenAI. Yesterday, the company submitted a draft registration statement to the US Securities and Exchange Commission for a proposed initial public offering (IPO) for common stock. It has yet to set the price of shares but a May funding round which raised $65 billion valued the company at around $965 billion (£717 billion), more than rival OpenAI, makers of chatbot ChatGPT. It is set to be a monster year for IPOs, with Elon Musk’s SpaceX and OpenAI also anticipated to join the frenzy. Each is expected to be valued at around $1 trillion. Claude Code has bolstered Anthropic’s reputation and has been well-received by some developers. Reportedly, Anthropic earns more in revenue despite having a fraction of the users OpenAI claims to serve. According to the Wall Street Journal, Anthropic is on the verge of reporting its first quarter of operating profit, according to people at the company who spoke anonymously. ®

The Police Service of Northern Ireland (PSNI) is warning the public to be wary of scammers spoofing its switchboard number in an attempt to profit by calling marks from a "trustworthy" number. A member of the public reported an attempted scam on Monday afternoon. A phone call came in from what appeared to be the PSNI’s switchboard number, and the caller pretended to be a member of the force inquiring about a case in which the recipient was involved. “The caller told the person there was an investigation linked to their name involving money transfers to narcotic-related countries and was subsequently asked to provide information about their bank cards,” said the PSNI’s Inspector Walker. We don’t have any expert criminals here at The Register, but we think it would be pretty sage advice for someone looking to increasingly pass as a police representative not to be so stupid as to ask for gift cards as “part of the investigation process.” “The caller then asked them to purchase gift cards and send across the codes for those, stating that this was part of the investigation process and that the money would be returned to them,” Inspector Walker added. “This made the reporting party suspicious, however, and thankfully, the victim didn’t share any of their personal or bank details with the caller, who they then blocked.” Officials confirmed to The Register that the police’s number was spoofed, and this case was not instigated by a real member of the switchboard team. Spoofing the switchboard’s phone number marked “a very concerning situation,” Walker said, urging the public to remain vigilant to similar calls. The PSNI is continuing to make follow-up enquiries about the report, but has not yet detained any individual in connection with the attempted fraud. Anyone who falls victim to digital fraud in the UK should contact the police, their bank, and Action Fraud, all of which can offer the necessary assistance. “Our advice is that you should never disclose your personal or financial details over the phone, in person, or by email, to someone you don't know,” said Walker. “Guarding your personal and banking details is essential.” The attempted scam is the second disclosed by the PSNI in as many days. On Monday, it warned of a separate case involving an elderly woman being defrauded of a sum north of £250,000 ($336,000) after being targeted by individuals operating a fake cryptocurrency scheme. “After initially sending a relatively small amount, the woman then ‘invested’ larger amounts on a number of occasions after the criminals convinced her that she needed to send more in order to get her initial investment back,” said Detective Inspector Moffett, of the PSNI’s Serious Crime Branch. “After she unknowingly downloaded malware at their instruction, they were able to gain control of her electronic devices and, we believe, transfer further sums from her account.” Cryptocurrency investment scams are among the most pervasive in the world, with figures from the US suggesting the problem is growing increasingly severe. According to the FBI’s annual digital crimes report, it received 48 percent more complaints about crypto investment scams last year than it did the year before, with losses also rising 25 percent. Much of this pain was shouldered by those aged 60 and over, the agency added. ®

Security researchers on Monday found dozens of Red Hat npm package releases infected with the Mini Shai-Hulud worm that TeamPCP cybercriminals recently open-sourced. The new supply chain attack hit at least 32 npm package releases published under the Red Hat Cloud Services namespace, according to security researchers from Google-owned Wiz, who traced the malware to one Red Hat employee’s compromised GitHub account. They said the affected packages are downloaded around 80,000 times a week. “The compromised account pushed malicious orphan commits to two RedHatInsights repositories, bypassing code review,” the threat hunters said in a Monday blog. “This happened across two waves of activity.” Wiz considers this a “live threat,” and says its researchers are actively monitoring it for any new developments. Socket, meanwhile, counted 95 affected package versions as of 11:00:22 UTC. The supply-chain security shop continues to monitor the ongoing attack and update the artifacts list – so be sure to check it out, and if your organization or any development pipelines have installed one of the poisoned versions, assume compromise and immediately rotate credentials. The compromised versions execute a hidden payload through a preinstall hook so that the malware automatically runs during the npm install process – before a developer imports or uses the package. “Based on Socket’s analysis, the payload is designed to collect GitHub Actions secrets, npm tokens, cloud credentials, Kubernetes and Vault material, SSH keys, Git credentials, and other sensitive files,” Socket’s research team wrote on Monday. “It also includes encrypted exfiltration logic and GitHub-based fallback mechanisms, indicating that the attacker was not only attempting to steal credentials, but also potentially enable further supply chain propagation.” A Red Hat spokesperson told The Register that the IBM-owned software firm is aware of the reports. “We immediately initiated an investigation and removed the packages from the npm registry,” the spokesperson said. “The packages are strictly limited to internal development, and the malicious code was never published for customer consumption via the console.redhat.com system. While our investigation is ongoing, we have not identified any impact to customer or partner environments or Red Hat production systems.” Both security firms say the malware resembles the Mini Shai-Hulud worm – but because TeamPCP open sourced the credential-stealing tool, it’s tough to say whether TeamPCP or a copycat crew is responsible for the latest developer-targeting supply chain infection. According to Wiz, the modifications look “largely cosmetic, with references to the Dune universe replaced by Greek mythology themes (i.e ‘spartan’), while the underlying functionality and tradecraft remain substantially similar.” One of the notable changes, the security sleuths said, is that the new variant adds data collectors for Google Cloud Platform and Microsoft Azure identities, and this new capability snarfs up all the identities that the infected machine has access to, as opposed to just stealing secrets from the cloud environments. This suggests “an increased attacker focus on gaining and leveraging access to the cloud itself,” Wiz warns. This variant also creates repositories containing the description “Miasma: The Spreading Blight.” And unlike earlier variants of the self-spreading worm that copied themselves, this one generates a uniquely encrypted payload for each infection, which makes hash-based indicators-of-compromise useful only for a specific package version. ®