Cybercriminals are distributing malware through GitHub repositories designed to look like genuine development projects. Researchers at Doctor Web found malicious code in Microsoft Visual Studio projects, Python scripts and Go files. Over 2000 computers were reportedly infected with this malware.
The campaign began around 2 years ago with the initial targets being cryptocurrency users. The repositories were themed around blockchain games, game bots and cheating tools.
The repositories even included guidance for installing Visual Studio to make them seem more legitimate to less experienced developers.
However the malware has now targeted information security professionals. The malicious code is hidden within repositories that claim to be for automated scanning, security testing and log analysis. The infected files have malicious code hidden in the configuration and source code of the repository. The malicious code is hidden with lots of white space.
When the malicious project is downloaded, it runs PowerShell scripts that fetch further malicious files from external sources. This results in an archive being downloaded containing Microsoft.exe, which is a malware loader built with Electron. The malware has been identified as Trojan.Loader.3261.
Once active, the malware gathers information about the system, creates persistence and downloads further payloads. It also tries to disable Windows Defender, User Account Control, alerts and recovery features.
The malware uses various methods to avoid being monitored by security tools, hijack legitimate windows processes and avoid detection from endpoint detection systems.
The malware includes payloads such as BackDoor.AsyncRAT.115 which allows the attacker to remotely access the infected computer. It also includes Trojan.InjectNET.14 which adds a cryptocurrency hijacker to the clipboard. This changes the copied wallet addresses to ones controlled by the attacker.
It also takes screenshots of the infected system.
The malware also includes JS.Stealer.191 which steals information from browsers, VPNs, messaging applications, gaming accounts, FileZilla and Discord. This information is zipped up and sent to the attacker via a Telegram bot.
The malware tries to uninstall security tools from ESET, McAfee and Malwarebytes. It also changes the hosts file in windows to prevent access to certain anti virus domains.
The researchers found multiple variations of how the malware was deployed. They also found other incomplete components which indicates that the malware is still being developed. Future features could include auto reinstall, better persistence, managing applications when they open and updating software.
This shows that even information security professionals can be vulnerable to malicious resources. The researchers recommend checking any files you download, keeping anti virus databases up to date and being cautious when cloning unknown GitHub repositories.
Read the original article:
Hackers Infiltrate GitHub Projects to Infect Cybersecurity Developers With Advanced Malware