Malware attacks on Docker Hub spread millions of malicious repositories

Docker Hub Office
(Image credit: Shutterstock)

Cybersecurity researchers from JFrog recently discovered three malicious campaigns in Docker Hub - Docker’s cloud-based registry service for storing and sharing container images. These campaigns contained millions of repositories that pushed generic trojan malware to the developers. 

The conclusion of JFrog’s findings is that with open-source repositories such as Docker Hub, keeping them clean of malware is an immensely difficult task.

As the researchers explained, Docker Hub repositories have two key aspects: the images (an application that can be updated and accessible through a fixed name), and the metadata (short descriptions and documentation in HTML format, which will be displayed on the repository’s main page).

Millions of bad repositories

“Usually, repository documentation aims to explain the purpose of the image and provide guidelines for its usage,” the researchers explained.

However, roughly 4.6 million repositories contained no Docker images, meaning they couldn’t be run using a Kubernetes cluster, or a Docker engine - they were practically useless. They just contained the overview page which tried to trick the developers into visiting phishing websites, or other pages hosting malicious code.

Of the 4.6 million repositories, 2.81 million were linked to three campaigns: “Downloader”, “eBook Phishing”, and “Website SEO”.

In terms of the number of malicious repositories, Downloader was the biggest one, amounting to almost 10% of the entire share (1,453,228 repositories). However, it did not have as many users (9,309) as, for example, Website SEO (194,699). The latter, however, only took up 1.4% of the share, having a “mere” 215,451 repositories.

With 7.1% of the share, eBook Phishing was the second, with 1,069,160 repositories. It only had 1,042 users though. 

JFrog disclosed its findings to Docker, which prompted the project to remove the malicious repositories - 3.2 million of them. 

"Unlike typical attacks targeting developers and organizations directly, the attackers in this case tried to leverage Docker Hub's platform credibility, making it more difficult to identify the phishing and malware installation attempts," JFrog said.

"Almost three million malicious repositories, some of them active for over three years highlight the attackers' continued misuse of the Docker Hub platform and the need for constant moderation on such platforms."

More from TechRadar Pro

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
An abstract image of digital security.
Hundreds of GitHub repositories hijacked to trick users into downloading malware
GitHub Webpage
A cracked malicious version of a Go package lay undetected online for years
A white padlock on a dark digital background.
GitHub is hiding malware disguised as games, legitimate software
Pirate skull cyber attack digital technology flag cyber on on computer CPU in background. Darknet and cybercrime banner cyberattack and espionage concept illustration.
Microsoft reveals over a million PCs hit by malvertising campaign
Docker Hub Office
False malware alert is leading Docker Desktop to be blocked on Apple Macs
Insecure network with several red platforms connected through glowing data lines and a black hat hacker symbol
BadBox malware hit after infecting over 500,000 Android devices
Latest in Security
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Google Chrome
Google Chrome security flaw could have let hackers spy on all your online habits
cybersecurity
Chinese government hackers allegedly spent years undetected in foreign phone networks
Data leak
A major Keenetic router data leak could put a million households at risk
Latest in News
Xbox Series X and Xbox wireless controller set to a green background
Xbox Insiders are currently testing a new Game Hub feature that looks useful, but I've got mixed feelings about it
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Microsoft Surface Laptop and Surface Pro devices on a table.
Hate Windows 11’s search? Microsoft is fixing it with AI, and that almost makes me want to buy a Copilot+ PC
Oura Ring 4
Activity tracking on Oura Ring is about to get a whole lot better, but I've got bad news about your step count
Google Pixel Buds Pro 2
Cleaned your Pixel Buds Pro 2 recently? If not, you might be getting worse sound
Google Maps on a phone being held in someone's hand
Google Maps is getting two key upgrades, for easier route planning and quicker access to Gemini AI