What happened

Cato Networks' CTRL team documented a campaign that weaponizes Claude Code skills to deliver MedusaLocker ransomware on the host machine. The skill description appears legitimate ("productivity helper") but the SKILL.md contains an embedded instruction sequence that the agent dutifully executes, dropping the loader.

Impact

Full host compromise + file encryption. Once the loader is on disk, MedusaLocker proceeds with its usual TTPs.