[Analysis] Massive Active GitHub Malware Campaign | Hundreds of Malicious Repositories Identified

I’ve spent the last several hours investigating what I initially thought was a single malicious fork of a macOS app. It turns out to be part of a massive, coordinated campaign with hundreds of active malicious repositories. Automated malware distribution campaign targeting GitHub users. Distinct pattern makes it easy to identify but GitHub hasn’t taken action despite reports. Fork legitimate open-source projects Replace all download links with direct .ZIP files containing malware README characteristics: Every section header has emojis (🚀 Getting Started, 📥 Download, 🤝 Contributing) Multiple repeated download links throughout Links point to unusual paths (e.g., .xcassets directories) Account structure: 2 repositories: the hijacked project + username.github.io Emoji prefix in repo description Manipulated commit history (backdated to look established) Timing: All created/updated recently Example Repos github.com/KUNDANIOS/TheCha86 github.com/Wothan12/KavaHub github.com/usamajhn/Cute-Writing-Assistant github.com/msksystem/ZeroScout github.com/ershikwa/mlwr_blogs Details Multi-stage execution using LuaJIT Anti-analysis techniques (sandbox detection, long sleeps) Targets: cryptocurrency wallets, browser credentials, cloud tokens C2 infrastructure disguised as Microsoft Office domains VirusTotal detection: Low (12/66 vendors) suggesting recent deployment MITRE ATT&CK Tactics: – Execution (T1059) – Defense Evasion (T1140, T1497, T1562) – Discovery (T1082, T1012, T1057) – Command & Control (T1071, T1573, T1090) This is not isolated. Hundreds of repos following identical patterns. The consistency suggests bot-driven deployment. Repos updated within the last 24 hours. This is happening alongside Shai-Hulud, WebRAT, PyStoreRAT, and Banana Squad campaigns. Searching GitHub for repositories with: – Topics including “malware”, “deobfuscation”, “symbolic-execution” – README with emoji headers + direct .zip download links Will reliably identify malicious repos. My original write-up: https://brennan.day/the-curious-case-of-the-triton-malware-fork/ Includes detailed analysis of one sample, file hashes, network IOCs, and discussion of the broader GitHub security crisis. Please help document this. submitted by /u/WanderBetter [link] [comments]Technical Information Security Content & DiscussionRead More