This new phishing strategy uses GitHub comments to spread malware
- Github repositories are becoming infected with malware
- Trusted repositories can bypass secure web gateways
- Github comments are also used to hide malicious files
In a new phishing campaign detected by Cofense Intelligence, threat actors took a novel approach by leveraging trusted GitHub repositories to spread malware. The campaign aims to leverage the inherent trust that many organizations place in GitHub as a developer platform.
Rather than creating malicious repositories, attackers opted to embed malware in legitimate repositories affiliated with tax organizations such as UsTaxes, HMRC and Inland Revenue.
This allowed them to bypass Secure Email Gateway (SEG) protections, posing a significant cybersecurity challenge. The attack also capitalized on the sense of urgency associated with filing taxes after the April deadline in the US.
Phishing tactic – abuse of trusted repositories
Emails associated with the campaign contained links to archives hosted on GitHub. Unlike traditional phishing attacks that rely on suspicious links or attachments, these emails appeared credible because the GitHub repositories used were legitimate, well-known and could bypass Secure Web Gateways.
The archive files linked in the emails were password protected, a tactic used to add an air of legitimacy. This protection also made it more difficult for malware scanners to detect and inspect the archive’s contents. Once opened, the password-protected files installed the Remcos Remote Access Trojan (RAT) on the victim’s system, giving attackers remote control of the infected device.
A key part of this campaign was the use of GitHub comments to upload malicious files. GitHub comments are typically used by developers to communicate about the contents of a repository, propose changes, or document issues. However, attackers exploited this feature by uploading malware-laden files in comments instead of the repository’s source code, allowing them to bypass usual security protocols and ensure the malware remained hidden.
Even if the original comment containing the malware link was deleted, the malware itself remained accessible through the repository’s file folder. This method has been used before, most notably with the Redline Stealer malware, but this campaign represents a significant escalation in the use of GitHub comments as a malware distribution vector.
The campaign primarily targeted the financial and insurance industries, with both sectors being particularly vulnerable during tax season as they handle a large amount of sensitive financial data.
It appears the attackers tested the waters with a smaller campaign, focusing on these two industries. Previous phishing campaigns using techniques such as QR codes had broader goals, but the narrower focus of this attack suggests that the threat actors were experimenting with the GitHub-based method before scaling up.
Phishing campaigns remain one of the most persistent and effective tactics used by cybercriminals to gain unauthorized access to sensitive information.
These attacks usually involve deceptive emails or messages that trick users into clicking malicious links, downloading malicious attachments, or divulging personal information.
Over the years, phishing techniques have evolved, becoming more sophisticated and harder to detect. Cybercriminals are now taking advantage of trusted platforms, disguising malicious intent behind legitimate-looking messages and using advanced social engineering techniques.
