Hackers look to trick GitHub users with intricate malware

Representational image depecting cybersecurity protection
(Image credit: Shutterstock)

GitHub users are under attack once again after researchers spotted yet another creative malware campaign.

This campaign seeks to deliver clipper malware, and has a unique approach to increase visibility, while decreasing the chances of being flagged by antivirus programs.

According to cybersecurity researchers from Checkmarx, an unnamed threat actor created malicious GitHub repositories, using names and topics that are popular and frequently searched for. Then, they automated the update mechanism, regularly changing the date, and other meaningless information, in the log file. That way, the repository was always at the very top of the search results, especially in the “recently updated” category.

Keysetzu clipper

The hackers also used fake accounts to add positive reviews and five-star ratings to further boost the malware’s visibility and credibility. While this isn’t a new technique, the threat actors didn’t overdo it with great ratings this time around, keeping a low profile.

At the same time, the malware was padded with many zeros, artificially inflating its size to exceed 32MB. That way, many antivirus programs and platforms, including VirusTotal, did not scan it.

The goal of the campaign was to drop clipper malware. Clippers usually steal clipboard information (copy/paste data) and are often used in cryptocurrency theft. When sending money, crypto users usually copy and paste the recipient’s wallet address (since it’s a long string of random characters and impractical, if not impossible, to memorize). In this process, the clipper malware will replace the recipient’s wallet with that of the attackers, tricking the victim into sending their money to the wrong address.

Unless the money is being transferred from a centralized exchange, the transactions are impossible to stop or revert. The money is gone for good.

Analyzing the malware, the researchers said it bears many similarities to the Keyzetsu clipper, which was first observed in mid-2023. Apparently, it will not activate on a computer located in Russia. 

More from TechRadar Pro

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
An abstract image of digital security.
Hundreds of GitHub repositories hijacked to trick users into downloading malware
A white padlock on a dark digital background.
GitHub is hiding malware disguised as games, legitimate software
Image depicting a hand on a scanner
New Lazarus Group campaign sees North Korean hackers spreading undetectable malware through GitHub and open source packages
North Korean flag with a hooded hacker
North Korean hackers are posing as software development recruiters to target freelancers
A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system
These fake GitHub "security alerts" could actually let hackers hijack your account
Pirate skull cyber attack digital technology flag cyber on on computer CPU in background. Darknet and cybercrime banner cyberattack and espionage concept illustration.
Microsoft reveals over a million PCs hit by malvertising campaign
Latest in Security
Isometric demonstrating multi-factor authentication using a mobile device.
NCSC gets influencers to sing the praises of 2FA
Sam Altman and OpenAI
OpenAI is upping its bug bounty rewards as security worries rise
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Dangerous new CoffeeLoader malware executes on your GPU to get past security tools
China
Notorious Chinese hackers FamousSparrow allegedly target US financial firms
A digital representation of a lock
NYU website defaced as hacker leaks info on a million students
NHS
NHS IT supplier hit with major fine following ransomware attack
Latest in News
cheap Nintendo Switch game deals sales
Nintendo didn't anticipate that Mario Kart 8 Deluxe was 'going to be the juggernaut' for the Nintendo Switch when it was ported to the console, according to former employees
Three angles of the Apple MacBook Air 15-inch M4 laptop above a desk
Apple MacBook Air 15-inch (M4) review roundup – should you buy Apple's new lightweight laptop?
Witchbrook
Witchbrook, the life-sim I've been waiting years for, finally has a release window and it's sooner than you think
Amazon Echo Smart Speaker
Amazon is experimenting with renaming Echo speakers to Alexa speakers, and it's about time
Shigeru Miyamoto presents Nintendo Today app
Nintendo Today smartphone app is out now on iOS and Android devices – and here's what it does
iPhone 13 mini
The iPhone mini won't be returning, according to rumors – and you think that's a mistake