Monday , March 31 2025
hackers

ReversingLabs report
Hackers Abusing GitHub Platform Hosting Malware

Researchers found two new techniques on GitHub. One uses GitHub Gists, and the other uses Git commit messages to send commands.

Malware creators sometimes upload their malware to Dropbox, Google Drive, OneDrive, and Discord to hide it and avoid being detected.

CVE-2025-1268
Patch urgently! Canon Fixes Critical Printer Driver Flaw

Canon has announced a critical security vulnerability, CVE-2025-1268, in printer drivers for its production printers, multifunction printers, and laser printers....
Read More
CVE-2025-1268  Patch urgently! Canon Fixes Critical Printer Driver Flaw

Within Minute, RamiGPT To Escalate Privilege Gaining Root Access

RamiGPT is an AI security tool that targets root accounts. Using PwnTools and OpwnAI, it quickly navigated privilege escalation scenarios...
Read More
Within Minute, RamiGPT To Escalate Privilege Gaining Root Access

Australian fintech database exposed in 27000 records

Cybersecurity researcher Jeremiah Fowler recently revealed a sensitive data exposure involving the Australian fintech company Vroom by YouX, previously known...
Read More
Australian fintech database exposed in 27000 records

Over 200 Million Info Leaked Online Allegedly Belonging to X

Safety Detectives' Cybersecurity Team found a forum post where a threat actor shared a .CSV file with over 200 million...
Read More
Over 200 Million Info Leaked Online Allegedly Belonging to X

FBI investigating cyberattack at Oracle, Bloomberg News reports

The Federal Bureau of Investigation (FBI) is probing the cyberattack at Oracle (ORCL.N), opens new tab that has led to...
Read More
FBI investigating cyberattack at Oracle, Bloomberg News reports

OpenAI Offering $100K Bounties for Critical Vulns

OpenAI has increased its maximum bug bounty payout to $100,000, up from $20,000, to encourage the discovery of critical vulnerabilities...
Read More
OpenAI Offering $100K Bounties for Critical Vulns

Splunk Alert User RCE and Data Leak Vulns

Splunk has released a security advisory about critical vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. These issues could lead...
Read More
Splunk Alert User RCE and Data Leak Vulns

CIRT alert Situational Awareness for Eid Holidays

As the Eid holidays near, cybercriminals may try to take advantage of weakened security during this time. The CTI unit...
Read More
CIRT alert Situational Awareness for Eid Holidays

Cyberattack on Malaysian airports: PM rejected $10 million ransom

Operations at Kuala Lumpur International Airport (KLIA) were unaffected by a cyber attack in which hackers demanded US$10 million (S$13.4...
Read More
Cyberattack on Malaysian airports: PM rejected $10 million ransom

Micropatches released for Windows zero-day leaking NTLM hashes

Unofficial patches are available for a new Windows zero-day vulnerability that allows remote attackers to steal NTLM credentials by deceiving...
Read More
Micropatches released for Windows zero-day leaking NTLM hashes

ALSO READ:

Fake security researchers push malware files on GitHub

The threat research team at ReversingLabs has seen more malware being hosted on GitHub recently.

Abusing GitHub Gists

Gists is a feature on GitHub that lets developers easily share code snippets. Code snippets can be shared publicly or privately.

“Secret gists don’t show up in Discover and are not searchable unless you are logged in and are the author of the secret gist. Secret gists aren’t private. If you send the URL of a secret gist to a friend, they’ll be able to see it”, reads Gists documentation.

The files don’t show up on the author’s GitHub profile, making it possible to use them as an anonymous Pastebin service without raising any red flags for an attacker.

“In this incident, several PyPI packages presented themselves as libraries for handling network proxying, and contained a Base64 encoded string, allegedly related to telemetry data, but containing a URL, pointing to a secret Gist”, ReversingLabs shared in a report with Cyber Security News.

Malware developers use Base64 encoding to hide the true purpose of a string and evade detection by security technologies. Binary data is often encoded using Base64 before being sent over a network.

Fetching and executing commands from a Base64 encoded URL

The setup.py file had hidden harmful code added to it, which was then executed using the setup tools commands.

Sending Commands Through Git Commit Messages

Researchers found a malicious code in the easyhttprequest PyPI package. The code takes advantage of version control systems. The code was hidden in the setup.py file by extending the egg_info setuptools command.

Source: ReversingLabs

“After installation on the victim’s machine, the malicious code from this package clones a specific git repository from GitHub and checks if the “head” commit of this repository contains a commit message that starts with a specific string”, researchers said.

Fetching and executing commands from a Base64 encoded commit message

Recommendation

Developers and application security teams need to identify harmful and legitimate packages on these platforms because attackers are becoming better at deploying malware. Software developers should use advanced tools that use detailed binary analysis to ensure complete security of the software supply chain.

Source: ReversingLabs

 

Check Also

million

Oracle refutes breach after hacker claims 6 million data theft

A hacker known as “rose87168” claims to have stolen six million records from Oracle Cloud …

Leave a Reply

Your email address will not be published. Required fields are marked *