GitHub Trojan Malware Campaign: 10,000 Malicious Repositories Identified

A security researcher has identified a massive malware distribution campaign on GitHub involving approximately 10,000 repositories. These repositories are designed to appear as legitimate clones of existing projects to trick users into downloading Trojan malware via zip archives linked in their README files.

The Malware Distribution Mechanism

Attackers are creating new repositories that are not forks, but direct copies of existing projects. To build trust and bypass security filters, these malicious repos preserve the original project's commit history and contributor list.

The "Commit-Cycling" Pattern

The campaign employs a specific behavioral pattern to maintain visibility and evade detection:

  • Frequent Updates: Every few hours, the previous commit is deleted and a new one is pushed.
  • Single File Modification: The only change in these commits is the addition or update of a link to a zip archive in the README.md file.
  • Consistent Naming: Most of these commits are titled "Update README.md".

This behavior is likely intended to keep the repositories at the top of "Last Updated" search results and search engine indexing, ensuring they appear to users searching for low-volume terms.

Malware Payload and Detection

The malicious zip archives typically contain four files:

  1. Application.cmd or Launcher.cmd
  2. loader.exe or luajit.exe (or other similar names)
  3. A .cso or .txt file with a random name
  4. lua51.dll

While submitting a direct link to the archive to VirusTotal often returns zero detections, submitting the zip file itself triggers Trojan alerts. Community analysis suggests the malware may be related to the Disco Trojan family and is likely designed to steal cryptocurrency, with observed network communication involving Polygon RPC nodes (drpc) and IP retrieval services.

Discovery and Detection Methodology

Researcher "theorchid" used a combination of the GitHub API and gharchive to identify the campaign at scale. Because the GitHub API limits requests to 5,000 per hour, the researcher filtered for repositories updated between 1 and 24 times every 24 hours using event archives.

The final detection pattern used to identify the 10,000 repositories included:

  • Repositories updated 1-24 times daily.
  • The latest commit modifies only the README.md file.
  • The README.md contains a link to a zip archive.
  • The repository is a new project, not a fork, but contains copied commits from another source.
  • The contributors and repository names vary across the campaign.

Community Insights and Counterpoints

GitHub users and security analysts in the comments have highlighted several systemic vulnerabilities exposed by this campaign:

"GitHub has become a distribution hub for software used by lots of people with no ability or interest in auditing the software they use."

Key Concerns:

  • Search Engine Manipulation: Users noted that search engines like Bing may be more susceptible to returning these phishing or malicious clones in top results compared to Google.
  • Agent-Based Targeting: Some analysts hypothesize that the campaign is not targeting humans, but AI agents that automatically search for and add dependencies, creating "infection clusters."
  • Platform Negligence: Multiple users reported that GitHub support is slow or unresponsive to reports of obvious malware or pirated software, suggesting a lack of automated scanning for "releases" or zip archives.
  • OS-Level Vulnerabilities: The discussion emphasized that desktop operating systems (Windows, macOS, Linux) still allow third-party binaries to run with broad system access, shifting the burden of security to the user.

Conclusion

This campaign demonstrates a sophisticated approach to social engineering by leveraging the perceived trust of open-source history and the perceived authority of search engine rankings. While GitHub has begun deleting the identified repositories, the scale of the campaign suggests a persistent threat to users who download binaries from unverified GitHub repositories.

Sources