https://www.bleepingcomputer.com/news/security/github-comments-abused-to-push-malware-via-microsoft-repo-urls/ BleepingComputer.com logo * * * * [ ] [Login] [Sign up] * * * * [ ] [Login] [Sign up] * News + Featured + Latest + Frontier Communications shuts down systems after cyberattack Frontier Communications shuts down systems after cyberattack + MITRE says state hackers breached its network via Ivanti zero-days MITRE says state hackers breached its network via Ivanti zero-days + 22,500 Palo Alto firewalls 22,500 Palo Alto firewalls "possibly vulnerable" to ongoing attacks + CrushFTP warns users to patch exploited zero-day "immediately" CrushFTP warns users to patch exploited zero-day "immediately" + Critical Forminator plugin flaw impacts over 300k WordPress sites Critical Forminator plugin flaw impacts over 300k WordPress sites + GitHub comments abused to push malware via Microsoft repo URLs GitHub comments abused to push malware via Microsoft repo URLs + Preparing for IT exams? This library of study guides is now under $30 Preparing for IT exams? This library of study guides is now under $30 + The Week in Ransomware - April 19th 2024 - Attacks Ramp Up The Week in Ransomware - April 19th 2024 - Attacks Ramp Up * Tutorials + Latest + Popular + How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 + How to use the Windows Registry Editor How to use the Windows Registry Editor + How to backup and restore the Windows Registry How to backup and restore the Windows Registry + How to open a Windows 11 Command Prompt as Administrator How to open a Windows 11 Command Prompt as Administrator + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Virus Removal Guides + Latest + Most Viewed + Ransomware + Remove the Theonlinesearch.com Search Redirect Remove the Theonlinesearch.com Search Redirect + Remove the Smartwebfinder.com Search Redirect Remove the Smartwebfinder.com Search Redirect + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * VPNs + Popular + Best VPNs Best VPNs + How to change IP address How to change IP address + Access the dark web safely Access the dark web safely + Best VPN for YouTube Best VPN for YouTube * Forums * More + Startup Database + Uninstall Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide * Home * News * Security * GitHub comments abused to push malware via Microsoft repo URLs * * GitHub comments abused to push malware via Microsoft repo URLs By Lawrence Abrams * April 20, 2024 * 10:14 AM * 0 GitHub A GitHub flaw, or possibly a design decision, is being abused by threat actors to distribute malware using URLs associated with a Microsoft repository, making the files appear trustworthy. While most of the malware activity has been based around the Microsoft GitHub URLs, this "flaw" could be abused with any public repository on GitHub, allowing threat actors to create very convincing lures. Abusing GitHub's file upload feature Yesterday, McAfee released a report on a new LUA malware loader distributed through what appeared to be a legitimate Microsoft GitHub repository for the "C++ Library Manager for Windows, Linux, and MacOS," known as vcpkg. The URLs for the malware installers, shown below, clearly indicate that they belong to the Microsoft repo, but we could not find any reference to the files in the project's source code. https://github[.]com/microsoft/vcpkg/files/14125503/Cheat.Lab.2.7.2.zip https://github[.]com/microsoft/STL/files/14432565/Cheater.Pro.1.6.0.zip Finding it strange that a Microsoft repo would be distributing malware since February, BleepingComputer looked into it and found that the files are not part of vcpkg but were uploaded as part of a comment left on a commit or issue in the project. When leaving a comment, a GitHub user can attach a file, which will be uploaded to GitHub's CDN and associated with the related project using a unique URL in this format: 'https://www.github.com/ {project_user}/{repo_name}/files/{file_id}/{file_name}.' Instead of generating the URL after a comment is posted, GitHub automatically generates the download link after you add the file to an unsaved comment, as shown below. This allows threat actors to attach their malware to any repository without them knowing. Download link auto-generated when adding a file to a commentDownload link auto-generated when adding a file to a comment Source: BleepingComputer Even if you decide not to post the comment or delete it after it is posted, the files are not deleted from GitHub's CDN, and the download URLs continue to work forever. As the file's URL contains the name of the repository the comment was created in, and as almost every software company uses GitHub, this flaw can allow threat actors to develop extraordinarily crafty and trustworthy lures. For example, a threat actor could upload a malware executable in NVIDIA's driver installer repo that pretends to be a new driver fixing issues in a popular game. Or a threat actor could upload a file in a comment to the Google Chromium source code and pretend it's a new test version of the web browser. These URLs would also appear to belong to the company's repositories, making them far more trustworthy. Unfortunately, even if a company learns their repos are abused to distribute malware, BleepingComputer could not find any settings that allow you to manage files attached to your projects. Furthermore, you can only protect a GitHub account from being abused in this way and tarnishing your reputation by disabling comments. According to this GitHub support document, you can only temporarily disable comments for a maximum of six months at a time. However, restricting comments can significantly impact a project's development as it will not allow users to report bugs or suggestions. Sergei Frankoff, of automated malware analysis service UNPACME, did a livestream on Twitch about this bug just last month, saying that threat actors were actively abusing it. Weeks later... GitHub bug still dropping malware pic.twitter.com/ s165zOAsoI -- herrcore (@herrcore) March 27, 2024 As part of our research into this bug, BleepingComputer could only find one other repo, httprouter, abused to distribute malware in this way, and it was the same 'Cheater.Pro.1.6.0.zip' as seen in Microsoft's URLs. However, Frankoff told BleepingComputer that they discovered a similar campaign in March that utilizes the same LUA loader malware, which is called SmartLoader, disguised as the Aimmy cheat software. Frankoff told BleepingComputer that SmartLoader is commonly installed alongside other payloads, such as the RedLine information-stealing malware. BleepingComputer contacted both GitHub and Microsoft on Thursday about this abuse but did not receive a response. At the time of this publication, the information-stealing malware is still being distributed through links associated with Microsoft' GitHub repository. Related Articles: Fake cheat lures gamers into spreading infostealer malware Microsoft fixes two Windows zero-days exploited in malware attacks Malicious Visual Studio projects on GitHub push Keyzetsu malware Critical Forminator plugin flaw impacts over 300k WordPress sites Save $230 off Microsoft Visio Professional 2021 in this flash sale * CDN * Comment * File Upload * GitHub * Malware * Microsoft * * * * * Lawrence Abrams Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com. Lawrence's area of expertise includes Windows, malware removal, and computer forensics. Lawrence Abrams is a co-author of the Winternals Defragmentation, Recovery, and Administration Field Guide and the technical editor for Rootkits for Dummies. * Previous Article * Next Article Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] Popular Stories * Frontier Frontier Communications shuts down systems after cyberattack * MITRE MITRE says state hackers breached its network via Ivanti zero-days Follow us: * * * * * Main Sections * News * VPN Buyer Guides * SysAdmin Software Guides * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2024 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT