Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Github scam investigation: Thousands of “mods” and “cracks” stealing data

timsh.org

Post reply on HN
Print view View original

111–120 of 165 posts

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#111

Post by Jimmc414 »

What's concerning is that this repository appears to be the template that much of this malware was built from: https://github.com/Jalynn0922/steal-cook. This repo mentioned in the article has existed on GitHub for 3 years without being taken down.

Also, I am seeing firsthand that AI is not good at detecting this stuff. Claude's main problem in a code review of one of its descendants was the unethical use of an aim-bot.

edit: to clarify, my concern is about how this can exist on Github for 3 years. Thank you for compiling this and sharing your review. Great work.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#112

Post by catsma21 »

Aurornis wrote: post #110
catsma21 wrote: post #106

Earlier quoted context omitted.

> extract the Discord webhook links there's a large variety of malware, they don't all phone home the same way and they don't all phone home to discord

Did you read the linked article? The template they’re duplicating phones home via Discord. I’m not saying every malware uses Discord. I’m talking about the article.

i did, in fact, read the article. you said "a simple script to download these repos". the variety of malware would make the script not so simple, and not so effective.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#113

Post by Aurornis »

extraduder_ire wrote: post #98

> Less then 10% of them have open issues with complaints - others look just fine. I don't know why anyone running one of these schemes to distribute malware would even enable the issues tab on github, let alone not delete every issue posted containing keywords like malware, trojan, virus, etc. with a script. Are hidden until approved issues not supported on github? Is this caused by some limitation of creating these…

These people are following a guide. They don’t know the details of GitHub.

They don’t care about people who know enough to check the issues. They’re fishing for the people who blindly download and run things, not who look under the hood.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#114

Post by 0x0 »

compass_copium wrote: post #78
0x0 wrote: post #57

Earlier quoted context omitted.

I think I read somewhere that scammers set up an email distribution list / alias / forwarding from one something.onmicrosoft.com account to dozens of victims, and then they trigger a (real!) paypal email with that one something.onmicrosoft.com address as the recipient. So the email has a valid DKIM signature from paypal, then microsoft forwards that email to all the victims, which will still pass DKIM while amplifyin…

Is there a legitimate reason for them to forward paypal emails? Why not just not let that happen under any circumstances?

Most email providers support mail forwarding and distribution lists, but maybe they should have added some sort of opt-in confirmation when adding recipients outside the local domain...?

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#115

Post by timsh »

Jimmc414 wrote: post #111

What's concerning is that this repository appears to be the template that much of this malware was built from: https://github.com/Jalynn0922/steal-cook . This repo mentioned in the article has existed on GitHub for 3 years without being taken down. Also, I am seeing firsthand that AI is not good at detecting this stuff. Claude's main problem in a code review of one of its descendants was the unethical use of an aim-b…

It’s not included in the list since it’s the stealer itself - it’s not misleading, it says “stealer”/“grabber”. But yeah the fact that it’s out still there is scary

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#116

Post by arp242 »

linwangg wrote: post #69

This raises a big question: How effective is GitHub’s abuse reporting system against large-scale malware campaigns? If 1,000+ malicious repos can persist for months, does this mean GitHub lacks automated scanning or relies too much on user reports?

The abuse reporting on GitHub completely sucks. You need to send a support ticket, which typically takes more than a month to get a reply to. And if by that time the comment or repo has been deleted they'll say "well it's deleted now, so we can't do anything". Because yes, I'm going to let spam sit around for over a month on my repo... :-/

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#117

Post by Aurornis »

catsma21 wrote: post #112
Aurornis wrote: post #110

Earlier quoted context omitted.

Did you read the linked article? The template they’re duplicating phones home via Discord. I’m not saying every malware uses Discord. I’m talking about the article.

i did, in fact, read the article. you said "a simple script to download these repos". the variety of malware would make the script not so simple, and not so effective.

> the variety of malware would make the script not so simple, and not so effective.

The article is about using scripts to identify and download the malware. They identified over 1000 matching repos, which would contain Discord webhooks in the script.

Scanning and identifying has already been done. That’s literally what the article is about.

It’s right in the second paragraph:

> As soon as you download and launch any of these, all the data from your computer is collected and sent to some discord server

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#118

Post by cl3misch »

KomoD wrote: post #25

Fun fact: if you come across one of these discord webhooks you can delete them. Just curl -X DELETE https://discord.com/api/webhooks/ [...]

According to other comments stating how responsive Discord is to reports, it might be better to not delete these webhooks but instead report the connected users/servers.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#119

Post by kennysoona »

Terretta wrote: post #99
kennysoona wrote: post #28

Earlier quoted context omitted.

I wasn't even talking about people who paid for a cert, just people signing up to try and help. They are generally more annoying then helpful to people who can do anything more than install and uninstall programs. Without a doubt every search result I found on that forum from someone having a similar issue never resulted in a useful lead.

> Without a doubt every search result I found on that forum from someone having a similar issue never resulted in a useful lead. This was subsumed into answers.microsoft.com and it's turned into a few of those original "good with computers" retirees spending all day answering from within their own knowledge, now overwhelmed by countless individuals with names or flavors of English suggesting emerging economic zones "…

> This was subsumed into answers.microsoft.com and it's turned into a few of those original "good with computers" retirees spending all day answering from within their own knowledge,

Ah yeah, this is exactly what I was referring to!

> If the asker persists through enough (5 - 8?) turns until the copy paster grasps that they don't understand the problem, then it turns into (paraphrasing) "no clue, I'm not real but was just trying to help, try Microsoft support".

Yes! And if you are doing anything even slightly out of their grasp that requires doing something 'different', they assume you are doing something wrong or messing with stuff you shouldn't be, e.g. "You shouldn't be touching the registry" - ugh.

> This is so consistent, I wonder what is driving it. They seem to try to look official, but eventually say they are not actually Microsoft, and punt. What is this accomplishing? Why are they spending all this time? Is it some kind of training exercise or on-ramp to support jobs? Inquiring minds want to know!

I think it really is just older people who 'like' computers but never learned that much about them. They found a zone where they can mostly be helpful to people who know a little less then them, which is fine, but they don't understand maybe they should not try and solve every problem.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#120

Post by Jimmc414 »

linwangg wrote: post #69

This raises a big question: How effective is GitHub’s abuse reporting system against large-scale malware campaigns? If 1,000+ malicious repos can persist for months, does this mean GitHub lacks automated scanning or relies too much on user reports?

> If 1,000+ malicious repos can persist for months

3 years unfortunately

https://github.com/Jalynn0922/steal-cook

Post reply on HN