InfoSecBulletin Cybersecurity for mankind
Malware creators sometimes upload their malware to Dropbox, Google Drive, OneDrive, and Discord to hide it and avoid being detected.
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
ALSO READ:
The threat research team at ReversingLabs has seen more malware being hosted on GitHub recently.
Abusing GitHub Gists
Gists is a feature on GitHub that lets developers easily share code snippets. Code snippets can be shared publicly or privately.
“Secret gists don’t show up in Discover and are not searchable unless you are logged in and are the author of the secret gist. Secret gists aren’t private. If you send the URL of a secret gist to a friend, they’ll be able to see it”, reads Gists documentation.
The files don’t show up on the author’s GitHub profile, making it possible to use them as an anonymous Pastebin service without raising any red flags for an attacker.
“In this incident, several PyPI packages presented themselves as libraries for handling network proxying, and contained a Base64 encoded string, allegedly related to telemetry data, but containing a URL, pointing to a secret Gist”, ReversingLabs shared in a report with Cyber Security News.
Malware developers use Base64 encoding to hide the true purpose of a string and evade detection by security technologies. Binary data is often encoded using Base64 before being sent over a network.
The setup.py file had hidden harmful code added to it, which was then executed using the setup tools commands.
Sending Commands Through Git Commit Messages
Researchers found a malicious code in the easyhttprequest PyPI package. The code takes advantage of version control systems. The code was hidden in the setup.py file by extending the egg_info setuptools command.
“After installation on the victim’s machine, the malicious code from this package clones a specific git repository from GitHub and checks if the “head” commit of this repository contains a commit message that starts with a specific string”, researchers said.
Recommendation
Developers and application security teams need to identify harmful and legitimate packages on these platforms because attackers are becoming better at deploying malware. Software developers should use advanced tools that use detailed binary analysis to ensure complete security of the software supply chain.
Source: ReversingLabs
