Fake Security Researcher GitHub Repositories Deliver Malicious Implant

summerheat · Jun 15, 2023

https://vulncheck.com/blog/fake-repos-deliver-malicious-implant

In early May, VulnCheck came across a malicious GitHub repository that claimed to be a Signal 0-day. The team reported the repository to GitHub, and it was quickly taken down. The same scenario continued throughout May.

Recently, the individuals creating these repositories have put significant effort into making them look legitimate by creating a network of accounts and Twitter profiles, pretending to be part of a non-existent company called High Sierra Cyber Security, and even using headshots of legitimate security researchers from companies like Rapid7.

Each High Sierra Cyber Security account contains a malicious repository claiming to be an exploit for a well-known product, including Chrome, Exchange, Discord, and more. Some of the accounts even advertise their “findings” on Twitter.

Security researchers should understand that they are useful targets for malicious actors and should be careful when downloading code from GitHub. Always review the code you are executing, and don’t use anything you don’t understand.
Click to expand...

Log in or Sign up

Fake Security Researcher GitHub Repositories Deliver Malicious Implant

summerheat Registered Member

Log in or Sign up

Fake Security Researcher GitHub Repositories Deliver Malicious Implant

summerheat Registered Member

Useful Searches