Github scam investigation: Thousands of “mods” and “cracks” stealing data

Post by jeffhuys » Fri, Feb 28, 2025, 2:44 PM UTC

mplanchard wrote: post #50

klaas- wrote: post #11

I think Microsoft has a general problem with getting rid of unwanted things within their eco-system. I keep complaining that their feedback.azure.com portal is filled with spam/malware comments and links, but even internally their teams can't reach anyone to get it fixed. Example https://feedback.azure.com/d365community/idea/9d0b22d8-c025-...

These have got to be AI generated. The ones that mention details from the post are borderline comical: > Sounds like deleting a VM in Azure is as tedious as trying to manage resources in a complex role-playing game—one wrong step, and you’re stuck dealing with frustrating dependencies! If you’re tired of that kind of hassle, maybe it’s time to switch things up with Download SpinRP. Instead of deleting VMs in the righ…

Post by Liquix » Fri, Feb 28, 2025, 2:45 PM UTC

Aurornis wrote: post #75

These repos post to Discord webhooks to notify of newly compromised systems. I’ve found Discord to be responsive to abuse complaints in the past. If someone wrote a simple script to download these repos and extract the Discord webhook links I bet you could get Discord to shut down their accounts. In my past experience Discord was aggressive about this, going so far as to ban the accounts of people who had participate…

Post by catsma21 » Fri, Feb 28, 2025, 2:49 PM UTC

Aurornis wrote: post #75

These repos post to Discord webhooks to notify of newly compromised systems. I’ve found Discord to be responsive to abuse complaints in the past. If someone wrote a simple script to download these repos and extract the Discord webhook links I bet you could get Discord to shut down their accounts. In my past experience Discord was aggressive about this, going so far as to ban the accounts of people who had participate…

Post by catsma21 » Fri, Feb 28, 2025, 2:51 PM UTC

Aurornis wrote: post #96

vegadw wrote: post #88

I think to an extent Microsoft is the guilty party here. For may cracks Windows Defender will trip saying "Win32/Keygen" even if there's no actual malware https://www.microsoft.com/en-us/wdsi/threats/malware-encyclo... This trains people that do a lot of piracy to be used to turning off their antivirus to let something through, which is fine until it's not. It's like drugs, if we know a subset of the population will…

Bundling malware with keygens is a very common practice. It helps because the victim doesn’t suspect anything is wrong when the thing they downloaded appears to work, unlike the sham downloads in the linked article. Gives the attackers more time to exploit the system. You also need to look at the bigger picture: Keygens are something you very much do not want anywhere in a corporate environment for obvious reasons. B…

Post by Aurornis » Fri, Feb 28, 2025, 2:53 PM UTC

catsma21 wrote: post #106

Aurornis wrote: post #75

These repos post to Discord webhooks to notify of newly compromised systems. I’ve found Discord to be responsive to abuse complaints in the past. If someone wrote a simple script to download these repos and extract the Discord webhook links I bet you could get Discord to shut down their accounts. In my past experience Discord was aggressive about this, going so far as to ban the accounts of people who had participate…

> extract the Discord webhook links there's a large variety of malware, they don't all phone home the same way and they don't all phone home to discord