Cybersecurity researchers have uncovered a brand new marketing campaign wherein the risk actors have revealed greater than 67 GitHub repositories that declare to supply Python-based hacking instruments, however ship trojanized payloads as a substitute.
The exercise, codenamed Banana Squad by ReversingLabs, is assessed to be a continuation of a rogue Python marketing campaign that was recognized in 2023 as concentrating on the Python Bundle Index (PyPI) repository with bogus packages that had been downloaded over 75,000 instances and got here with information-stealing capabilities on Home windows techniques.
The findings construct on a earlier report from the SANS’s Web Storm Middle in November 2024 that detailed a supposed “steam-account-checker” device hosted on GitHub, which included stealthy options to obtain further Python payloads that may inject malicious code into the Exodus cryptocurrency pockets app and harvest delicate knowledge to an exterior server (“dieserbenni[.]ru”).
Additional evaluation of the repository and the attacker-controlled infrastructure has led to the invention of 67 trojanized GitHub repositories that impersonate benign repositories with the identical identify.
There may be proof to counsel that customers trying to find software program corresponding to account cleansing instruments and sport cheats corresponding to Discord account cleaner, Fortnite Exterior Cheat, TikTok username checker, and PayPal bulk account checker are the targets of the marketing campaign. All of the recognized repositories have since been taken down by GitHub.
“Backdoors and trojanized code in publicly out there supply code repositories like GitHub have gotten extra prevalent and symbolize a rising software program provide chain assault vector,” ReversingLabs researcher Robert Simmons stated.
“For builders counting on these open-source platforms, it is important to all the time double test that the repository you are utilizing really accommodates what you count on.”
GitHub as a Malware Distribution Service
The event comes as GitHub is more and more turning into the main focus of a number of campaigns as a malware distribution vector. Earlier this week, Development Micro stated it uncovered 76 malicious GitHub repositories operated by a risk actor it calls Water Curse to ship multi-stage malware.
These payloads are designed to siphon credentials, browser knowledge, and session tokens, in addition to to supply the risk actors with persistent distant entry to the compromised techniques.
Then Verify Level shed mild on one other marketing campaign that is utilizing a prison service often known as the Stargazers Ghost Community to focus on Minecraft customers with Java-based malware. The Stargazers Ghost Community refers to a group of GitHub accounts that propagate malware or malicious hyperlinks through phishing repositories.
“The community consists of a number of accounts that distribute malicious hyperlinks and malware and carry out different actions corresponding to starring, forking, and subscribing to malicious repositories to make them seem authentic,” Verify Level stated.
The cybersecurity firm has additionally assessed that such “GitHub ‘Ghost’ accounts are just one a part of the grand image, with different ‘Ghost’ accounts working on totally different platforms as an integral a part of a good bigger Distribution-as-a-Service universe.”
Some elements of the Stargazers Ghost Community had been uncovered by Checkmarx in April 2024, calling out the risk actor’s sample of utilizing faux stars and pushing out frequent updates to artificially inflate the recognition of the repositories and ensure they surfaced on prime of GitHub search outcomes.
These repositories are ingeniously disguised as authentic tasks, sometimes associated to well-liked video games, cheats, or instruments like cryptocurrency value trackers and multiplier prediction for crash-betting video games.
These campaigns additionally dovetail with one other assault wave that has focused novice cybercriminals looking out for available malware and assault instruments on GitHub with backdoored repositories to contaminate them with data stealers.
In a single occasion highlighted by Sophos this month, the trojanized Sakura-RAT repository has been discovered to include malicious code that compromised those that compiled the malware on their techniques with data stealers and different distant entry trojans (RATs).
The recognized repositories act as a conduit for 4 totally different sorts of backdoors which might be embedded inside Visible Studio PreBuild occasions, Python scripts, screensaver information, and JavaScript to steal knowledge, take screenshots, talk through Telegram, in addition to fetch extra payloads, together with AsyncRAT, Remcos RAT, and Lumma Stealer.
In all, the cybersecurity firm stated it detected at least 133 backdoored repositories as a part of the marketing campaign, with 111 containing the PreBuild backdoor, and the others internet hosting Python, screensaver, and JavaScript backdoors.
Sophos additional famous that these actions are possible linked to a distribution-as-a-service operation that has been operational since August 2022, and which has used 1000’s of GitHub accounts to distribute malware embedded inside trojanized repositories themed round gaming cheats, exploits, and assault instruments.
Whereas the precise distribution methodology used within the marketing campaign is unclear, it is believed that the risk actors are additionally counting on Discord servers and YouTube channels to unfold hyperlinks to the trojanized repositories.
“It stays unclear if this marketing campaign is instantly linked to some or all the earlier campaigns reported on, however the method does appear to be well-liked and efficient, and is prone to proceed in a single type or one other,” Sophos stated. “Sooner or later, it is doable that the main focus could change, and risk actors could goal different teams in addition to inexperienced cybercriminals and players who use cheats.”
Chet Wisniewski, director and discipline CISO at Sophos, advised The Hacker Information that “there are hanging similarities” between the marketing campaign and Water Curse. These embody traits corresponding to –
- Repositories with “extraordinarily comparable names”
- Broad use of GitHub accounts
- An identical deal with Electron purposes
- Comparable abuse of Visible Studio’s PreBuild parts, and
- A reference to the “ischhfd83” e mail deal with (“ischhfd83@rambler[.]ru”), which is used to make the commits to the GitHub repositories
“Whether or not these campaigns are carefully associated or just a part of a risk cluster working from the identical codebase and playbook deserves additional investigation,” Wisniewski added.
