New malware campaign in GitHub, accounts spreading malware using MediaFire

#1

Post by steveiliop56 » Tue, Aug 27, 2024, 10:09 AM UTC

Hello everyone,

There is a new malware campaign in GitHub where normal looking accounts are posting messages looking like this:

Download www.mediafire.com/file/DONOTCLICKMEORCOPY password: changeme In the installer menu, select "gcc."

I personally received 3 of these on the same issue but luckily GitHub takes action immediately and deletes the accounts when you report them.

Re: New malware campaign in GitHub, accounts spreading malware using MediaFire

#2

Post by thenickdude » Wed, Aug 28, 2024, 8:03 AM UTC

Same here on my issue tracker, seems to be GitHub wide.

https://i.imgur.com/jJljJp8.png

They reply with the message to new issues, which makes their notification email look like a direct solution to the submitter's issue, so they'll probably catch out a lot of people...

Re: New malware campaign in GitHub, accounts spreading malware using MediaFire

#3

Post by goldfishlaser » Thu, Aug 29, 2024, 10:40 PM UTC

Does anyone know what the malware does? I just saw this myself.

Re: New malware campaign in GitHub, accounts spreading malware using MediaFire

#4

Post by thenickdude » Wed, Sep 04, 2024, 9:47 AM UTC

goldfishlaser wrote: post #3

Does anyone know what the malware does? I just saw this myself.

A sandbox service identifies it as Lumma Stealer, so it'll at least steal all your passwords, cookies and cryptocurrency, and then anything else after that is fair game too:

https://socradar.io/malware-analysis-lummac2-stealer/