githash docs

A campaign that edits the README of thousands of GitHub repositories, many of them real developers' projects, so the Download button points at a ZIP committed inside the same repo. The ZIP holds a small .bat or .cmd launcher, a LuaJIT runner .exe and an obfuscated Lua payload (SmartLoader), which installs the StealC info-stealer. Every copy is re-packed with randomized names, often derived from the repo's own name, so no two copies share a hash. The operator re-aims the fleet in synchronized waves; one wave edited more than 13,000 repositories in 34 hours.

references

• https://www.bleepingcomputer.com/news/security/fakegit-malware-campaign-returns-with-17-610-malicious-github-repos/
• https://github.com/joshnck/luaJit_malware_report

spread over time

Press play to watch the threat spread, or drag the slider to pick dates.

known-malicious hashes · 87