Doctor Web found a campaign of malicious GitHub repositories dressed up as security tools: scan automation, testing helpers and log parsers, including a fake Fscan output cleaner, BleepingComputer reports. More than 2,000 Windows PCs were infected. The same crew used to bait crypto and gaming users and has now turned to security folks.
The gist
The malicious code hides inside project and source files, some of it set to run automatically when you build. The end result is a backdoor, a clipboard crypto-address swapper and an infostealer that goes after browser data, VPN settings and other accounts.
Vet what you clone
- Prefer official, well-known projects. Check who’s behind a repo, its history and its stars before you trust it.
- Read build scripts and project files before you build, and scroll all the way across source lines.
- Open and build unknown tools in a disposable VM, not on your daily machine.
- If you think you ran one, change your passwords from a clean device.
My take
Security people are juicy targets because our machines hold the keys. Trust, but verify, then run it in a box you can throw away.
God Bless, and Use the Source!
