GitHub Notification Emails Hijacked to Send Malware
A security incident reveals that GitHub notification emails can be hijacked to distribute malware, specifically "LUMMASTEALER," which targets sensitive information. Recommendations include improving email clarity and security measures.
Read original article
A recent security incident has revealed that GitHub notification emails can be hijacked to distribute malware. The attack begins when an attacker creates a fake issue on a public repository using a disposable GitHub account, then deletes it quickly. The repository owner receives a notification email that appears legitimate, often impersonating the GitHub Security Team. The email contains a link that, when clicked, leads to a malicious site disguised as a captcha challenge. This site instructs users to execute a PowerShell command that downloads and runs malware, specifically a variant known as "LUMMASTEALER." This malware is designed to search for sensitive information, such as cryptocurrency wallets and stored credentials, and send it to the attacker's servers. The incident highlights vulnerabilities in GitHub's notification system, which attackers exploit by controlling the email content and context. Recommendations for GitHub include enhancing email clarity and reducing the amount of content that attackers can manipulate. The author has reported the issue to GitHub security for further investigation.
- GitHub notification emails can be exploited to send malware.
- Attackers impersonate GitHub Security to trick users into clicking malicious links.
- The malware, identified as "LUMMASTEALER," targets sensitive data like cryptocurrency wallets.
- Recommendations for GitHub include improving email context and security measures.
- The incident underscores the need for vigilance among developers regarding email notifications.
Related
Nation-State Actors Targeting Software Supply Chain via GitHub [2023)
GitHub warns of Lazarus Group, linked to North Korea, targeting cryptocurrency, gambling, and cybersecurity sectors via social engineering. Group aims to breach software supply chains for financial gain. Panther Labs offers security workshop.
A Hacker 'Ghost' Network Is Quietly Spreading Malware on GitHub
Cybersecurity researchers discovered a network of 3,000 fake GitHub accounts, "Stargazer Goblin," spreading malware like ransomware. The operation manipulates GitHub tools, targeting Windows users seeking free software.
A Hacker 'Ghost' Network Is Quietly Spreading Malware on GitHub
Cybersecurity researchers discovered a network of 3,000 fake GitHub accounts, "Stargazer Goblin," spreading malware like ransomware. The network manipulates GitHub's tools to promote malicious repositories targeting Windows users.
Hacker trap: Fake OnlyFans tool backstabs cybercriminals, steals passwords
Hackers are using a fake OnlyFans account checker to distribute Lumma malware among cybercriminals, highlighting the risks of betrayal and deception within the cybercrime community.
Nefarious actors attack from 3k shadow GitHub accounts, spreading malware
A cybercriminal network, Stargazer Goblin, uses 3,000 ghost accounts on GitHub to spread malware disguised as legitimate software, generating up to $100,000 while evading detection amid GitHub's vast user base.
- Many users express disbelief that anyone would fall for such obvious scams, highlighting the importance of skepticism towards email links.
- Several commenters share personal experiences with phishing attempts, noting that even legitimate companies can be spoofed.
- There is a consensus that GitHub and similar platforms need to improve their security measures to prevent such incidents.
- Some users emphasize the responsibility of individuals to be cautious and not execute commands from untrusted sources.
- Comments also discuss the broader implications of phishing attacks on developers and the need for better detection of malicious activity on platforms like GitHub.
36 commentsFirst, I assume the author knows the email came from github, as the screenshot does not show this very clearly. If that's the case:
Red flag #1: email links to a variation of real domain. If you don't have information on who github-scanner.com is, it is pretty safe to assume it's a scam , just because it sounds like a real website.
GIANT Enormous Huge Red Flag #2: captcha asks you to types command in shell. I have no comment on how naive one must be to do this.
This email came from the real PayPal.com, how they haven't gotten on top of usernames like that is beyond me for a payment processor. I reported it to them but haven't heard anything back, hopefully they banned that account but they should ban all names like that.
This email honestly was formatted to look like a legit PayPal email, I have to imagine that scam will trick a lot of normal people.
Get in touch, see my bio website, if you want the email.
Press Win+R, CTRL+V <enter>
I could see junior developers falling for this. Hey it's Github, it's legit right? We get security notifications every second months about some lib everyone uses etc.
"Oh look, captcha by running code, how neat!"
People need to stop actioning any links from emails and/or believing that any content in an email has legitimacy. It doesn't. That's problem number 2.
Problem number 3, Windows still let you root a machine by 1 line in powershell? What the @$$%&%&#$?
Github might need to stop people putting links in issues without being checked by automated services that can validate the content as remotely legitimate. They're sending this stuff to people's email, don't tell me they're not aware this could be used for fishing! That's cyber security 101, in 2015.
Finally, Github, in being unable to act on the above, may need to better strip what they email to people, and essentially behave more like banks "you have a new issue in this repository..." and that's that. You then go there, there is no message, ok great. That would have taken care of this issue...
It seems Github needs to graduate a bit here.
So is github-scanner.com (and github-scanner.shop) still the same malicious party? It seems to be. Funny that their DNS is hosted by Cloudflare (who, famously, don't host anything, because they think we're all dumb). Cloudflare, who take responsibility for nothing, has no way to report this kind of abuse to them.
The domain which hosts the malware, 2x.si, both uses Cloudflare for DNS and is hosted by Cloudflare. At least it's possible to report this to Cloudflare, even though they rate limit humans and have CAPTCHAs on their abuse reporting forms.
Sigh. Thanks to Cloudflare, it's trivial these days to host phishing and malware.
I realized I have never deleted an issue I started but doesn't people with admin access the only with ability to delete the issues on a repo? [1]. So actually there is a trace for that issue in the repository. Same thing for Pull requests.
[1] https://docs.github.com/en/issues/tracking-your-work-with-is...
Easy to be suspicious with the link alone, but its fun to see someone digging into it.
Try this, I think it will fix your issue (install GCC if you need a compiler): (Bitly link redirecting to zip file on mediafire) Pass: (something)
GitHub processed my abuse report within an hour and removed all posts by that user.
I got dozens of such spam during a whole day.
This is almost as easy as it was to call someone and asking them for the number of the modem on their desk and their logins back in the bad old days.
Considering the target platform I'm not overly surprised though.
Maybe devs' target value in general has growing to a point where the openness of the system is more of a vulnerability than service.
Might want to change the image too, macOS recognises the link in that and makes it clickable. I’d say that’s more dangerous than modifying it in the text of the post, you could just as well include a non-clickable text link.
Of all things that seem legit, this seems the legitest.
I also have no clue why any reasonable person would refer to that monstrosity as a CAPTCHA.
Related
Nation-State Actors Targeting Software Supply Chain via GitHub [2023)
GitHub warns of Lazarus Group, linked to North Korea, targeting cryptocurrency, gambling, and cybersecurity sectors via social engineering. Group aims to breach software supply chains for financial gain. Panther Labs offers security workshop.
A Hacker 'Ghost' Network Is Quietly Spreading Malware on GitHub
Cybersecurity researchers discovered a network of 3,000 fake GitHub accounts, "Stargazer Goblin," spreading malware like ransomware. The operation manipulates GitHub tools, targeting Windows users seeking free software.
A Hacker 'Ghost' Network Is Quietly Spreading Malware on GitHub
Cybersecurity researchers discovered a network of 3,000 fake GitHub accounts, "Stargazer Goblin," spreading malware like ransomware. The network manipulates GitHub's tools to promote malicious repositories targeting Windows users.
Hacker trap: Fake OnlyFans tool backstabs cybercriminals, steals passwords
Hackers are using a fake OnlyFans account checker to distribute Lumma malware among cybercriminals, highlighting the risks of betrayal and deception within the cybercrime community.
Nefarious actors attack from 3k shadow GitHub accounts, spreading malware
A cybercriminal network, Stargazer Goblin, uses 3,000 ghost accounts on GitHub to spread malware disguised as legitimate software, generating up to $100,000 while evading detection amid GitHub's vast user base.