InfoSecBulletin Cybersecurity for mankind
Recorded Future’s Insikt Group has discovered a major cyber threat campaign carried out by Russian-speaking hackers, possibly located in the Commonwealth of Independent States (CIS).
This campaign misuses GitHub, a platform for software development, to spread different malware. The report explains how attackers pretend to be popular software like 1Password, Bartender 5, and Pixelmator Pro to infect victims with malware that steals information like AMOS, Vidar, Lumma, and Octo. The malware variants have a shared command-and-control infrastructure, indicating a well-coordinated attack strategy to cause the most damage on different platforms.
Check Point said BreachForum post old data
Apple Warns of 3 Zero Day Vulns Actively Exploited
24,000 unique IP attempted to access Palo Alto GlobalProtect portals
CVE-2025-1268
Patch urgently! Canon Fixes Critical Printer Driver Flaw
Within Minute, RamiGPT To Escalate Privilege Gaining Root Access
Australian fintech database exposed in 27000 records
Over 200 Million Info Leaked Online Allegedly Belonging to X
FBI investigating cyberattack at Oracle, Bloomberg News reports
OpenAI Offering $100K Bounties for Critical Vulns
Splunk Alert User RCE and Data Leak Vulns
Hackers make GitHub profiles to share infected versions of popular software. When users download these apps, their devices get malware that can steal data and do harmful actions. This shows the hackers are adaptable and use shared command-and-control systems, suggesting a well-organized cyber attack.
Insikt Group’s analysis uncovered various malware families in this campaign, such as:
Atomic macOS Stealer (AMOS): Targets macOS users by impersonating commonly used applications.
Vidar and Lumma: Information stealers that target Windows devices.
Octo: A banking trojan specifically targeting Android devices.
Attackers effectively use GitHub to manage their malicious tools and target various operating systems with different types of malware.
The campaign uses complex tactics such as domain spoofing. This means that users are redirected from harmless websites to harmful GitHub repositories. The malware tricks users by pretending to be a necessary software update or additional software, making them unknowingly download it.
Insikt Group also uncovered the backend infrastructure used in this campaign, including multiple C2 servers and the use of public file-sharing services like Dropbox and Pixeldrain to spread additional payloads. The usage of FileZilla servers for managing and disseminating malware variants highlights the campaign’s sophistication.
Insikt Group recommends several mitigation strategies, including:
*Verify the authenticity of the download sources and maintain updated antivirus and anti-malware solutions.
* Employ tools like GitGuardian and GitHub Advanced Security to scan for potentially malicious code.
* Implement an organization-wide code review process for any externally obtained code before its integration into production environments.
