Hackers Exploit GitHub With Fake Projects To Spread Malware

According to Cointelegraph, cybersecurity firm Kaspersky has identified a significant malware campaign targeting GitHub users. Dubbed 'GitVenom,' this campaign involves hackers creating numerous fake repositories on GitHub, designed to deceive users into downloading malware that steals cryptocurrency and credentials. Kaspersky analyst Georgy Kucherin reported that these repositories host remote access trojans (RATs), info-stealers, and clipboard hijackers. The fake projects include a Telegram bot for managing Bitcoin wallets and a tool for automating Instagram interactions. Kucherin noted that the creators of these malicious projects have gone to great lengths to make them appear legitimate. They have included well-crafted information and instruction files, potentially generated using AI tools, to enhance credibility. Additionally, the hackers have artificially inflated the number of 'commits' or changes to the projects, adding multiple references to specific changes to give the impression of active development. This was achieved by placing a timestamp file in the repositories, updated every few minutes. Kaspersky's investigation revealed that these fake projects have been in existence for at least two years, indicating the efficiency of the infection vector. Despite the legitimate appearance, the projects do not implement the features described in the instruction files. Instead, they perform meaningless actions while delivering malicious payloads. These payloads include info-stealers that extract saved credentials, cryptocurrency wallet data, and browsing history, uploading them to hackers via Telegram. Another component, a clipboard hijacker, targets crypto wallet addresses, replacing them with those controlled by attackers. The GitVenom campaign has been observed globally, with a particular focus on users in Russia, Brazil, and Turkey. Kucherin emphasized the ongoing threat posed by such fake software on code-sharing platforms like GitHub, which are used by millions of developers worldwide. He advised users to scrutinize third-party code actions before downloading. Kaspersky anticipates that attackers will continue to publish malicious projects, potentially with minor changes in their tactics, techniques, and procedures.