A large-scale campaign using fake GitHub repositories is distributing infostealer malware disguised as trusted software projects. The malicious repositories imitate well-known applications and security tools, tricking users into downloading malware instead of legitimate software.
Researchers uncovered hundreds of fake repositories that targeted developers, cryptocurrency users, gamers, and anyone searching for popular security or productivity tools.
Nearly 300 Fake GitHub Repositories Discovered
Cybersecurity researchers identified the campaign after one of their own products was impersonated in late June.
Their investigation uncovered 292 fraudulent GitHub repositories, each containing a convincing README file with a download link leading to a malicious website.
The fake projects impersonated a wide range of software categories, including:
- Security products
- Cryptocurrency services
- Financial applications
- Developer tools
- Secure email platforms
- macOS utilities
- Gaming software
The attackers relied heavily on search engine visibility to attract victims looking for free software downloads.
Fake Download Pages Designed to Build Trust
Clicking a repository’s download link redirected visitors to a professional-looking landing page.
The websites displayed reassuring branding, including fake trust badges and download buttons labeled with phrases such as “Download Secure Content.”
Researchers found that every phishing page used the same HTML and JavaScript template. The attackers simply changed the branding dynamically to match whichever software project they were impersonating.
Malware Hidden Inside Signed Software
Victims who downloaded the archive received a ZIP file whose contents changed approximately every minute.
Inside the archive were two key files:
- A legitimate, digitally signed WinGUP updater.
- A malicious libcurl.dll library.
When the user launched the executable, the trusted updater side-loaded the malicious DLL. The malware then decoded and executed entirely in memory, making detection more difficult.
BoryptGrab Steals Passwords, Wallets, and Browser Data
The payload is a variant of the BoryptGrab information stealer.
Once running, it attempts to collect a wide range of sensitive information, including:
- Passwords, cookies, payment data, and browsing information from more than 19 web browsers.
- Data from 32 cryptocurrency wallet brands.
- Telegram sessions, Discord tokens, and Steam session tokens.
- Credentials for Meta’s Max messaging platform.
- Windows Credential Manager data.
- Files stored on the Desktop and in Documents that appear to contain passwords, wallet backups, or recovery phrases.
- Screenshots, system information, and software inventories.
Researchers also discovered a previously undocumented capability that allows this malware variant to bypass Chrome’s App-Bound Encryption by injecting code directly into the browser process.
Stolen Data Sent to Russian-Based Servers
After gathering information, the malware compresses the stolen data before sending it to a command-and-control server hosted in Russia.
Unlike many other infostealers, this campaign does not attempt to establish persistence on the infected system. Instead, it focuses on stealing as much information as possible during a single execution.
Researchers also noted the malware lacks sophisticated anti-analysis techniques and leaves temporary data behind on compromised systems, providing useful forensic evidence for investigators.
GitHub Removes Many Malicious Repositories
GitHub has already removed a large number of the fraudulent repositories identified during the investigation. However, several malicious GitHub Pages redirectors remained active when the research was published.
The researchers could not definitively attribute the operation to a specific threat group. However, based on the infrastructure and tactics involved, they believe the operators are likely Russian-speaking and financially motivated.
The campaign highlights the risks of downloading software from unofficial GitHub pages. Users should verify repository authenticity, avoid unofficial download links, and install software only from trusted developers or official project websites.
0 responses to “Fake GitHub Repositories Spread BoryptGrab Infostealer Through Trusted Software Downloads”