A series of malicious GitHub repositories masquerading as legitimate security research projects have been discovered.
VulnCheck researcher Jacob Baines shared the findings in a new advisory published today, claiming the repository contains exploits for well-known products such as Chrome, Exchange and Discord. .
“In early May, VulnCheck discovered a malicious GitHub repository claiming to be Signal 0-day. The team reported the repository to GitHub, but it was quickly removed. It lasted for a while.”
Perpetrators created a network of accounts and Twitter profiles and went to great lengths to make their profiles look authentic, including using headshots of legitimate security researchers, according to security experts. said to have paid
Repositories followed a similar pattern, luring users with promises of zero-day vulnerabilities. Upon closer inspection, the code within these repositories was found to contain malicious implants.
For more information on malicious code found on GitHub, see Researchers Uncover 7000 Malicious Open Source Packages.
The repository contained a Python script that downloaded and executed a malicious binary based on the victim’s operating system. Windows binaries reportedly had a higher detection rate on VirusTotal, while Linux binaries contained less conspicuous but still identifiable strings.
Bains said the motives behind these attacks remain unclear, but it’s evidence that security researchers are a prime target for malicious actors.
“Security researchers should understand that these are lucrative targets for malicious actors and should be careful when downloading code from GitHub. Always check and understand the code they are executing. Don’t use what you can’t,” concluded Baines.
More broadly, the increasing abuse of GitHub repositories by malicious actors highlights the growing threat and need for enhanced security measures.
To dig deeper into this issue and understand the evolving threat landscape, read this article by Paolo Passeri, Head of Cyber Intelligence at Netskope. This article explores the increasing exploitation of his GitHub by state-sponsored attackers.
Editorial image credit: Casimiro PT / Shutterstock.com
