Pierluigi Paganini
February 26, 2025
Kaspersky researchers warn of a malware campaign, dubbed GitVenom, targeting GitHub users. The threat actors behind this campaign created hundreds of fake GitHub repositories with malicious code, disguising them as automation tools, crypto bots, and hacking utilities.
The attackers used AI-generated README files to make fake GitHub repositories look legitimate, including project details and compilation instructions.
The threat actors also used tags and fake commits, updating a timestamp file every few minutes to trick victims into believing their GitHub repositories were active and legitimate.
The projects employed in the GitVenom campaign were in multiple programming languages. Python projects used code to install and run malicious scripts, while JavaScript projects contained functions to decode and execute malicious scripts. C, C++, and C# repositories included harmful batch scripts in Visual Studio files.
“While coded in different programming languages, the malicious payloads stored inside the fake projects had the same goal – download further malicious components from an attacker-controlled GitHub repository (URL at the time of research: hxxps://github[.]com/Dipo17/battle) and execute them.” reads the report published by Kaspersky.
The GitVenom campaign deployed a Node.js stealer to collect credentials and crypto data, AsyncRAT and Quasar backdoors for remote control, and a clipboard hijacker that replaced cryptocurrency wallet addresses, allowing operators to earn around 5 BTC (~$485,000).
Kaspersky researchers noticed that several fake projects were published two years ago. The researchers speculate that the campaign may have been active for several years. Most infection attempts were observed in Russia, Brazil, and Turkey.
“As code-sharing platforms such as GitHub are used by millions of developers worldwide, threat actors will certainly continue using fake software as an infection lure. For that reason, it is crucial to handle processing of third-party code very carefully.” concludes the report. “Before attempting to run such code or integrate it into an existing project, it is paramount to thoroughly check what actions it performs. This way, it will be very easy to spot fake projects and prevent malicious code placed in them from being used to compromise the development environment.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, GitHub)
