The misuse of GitHub infrastructure to stage the malicious payloads is a key component of the attack chain. In March 2024, researchers first revealed a variant of this technique, which entails threat actors creating a GitHub issue on popular repositories, uploading a malicious payload to it, and then closing the issue without storing any data. This has led to the discovery that the malware that was uploaded continues to exist even though the problem is never stored. This is a vulnerability that is easy to exploit since it enables attackers to upload whatever file they want and leave no evidence behind other than the file's link.

As reported this week, the technique has been turned into a weapon to fool users into downloading a Lua-based malware loader that can install itself on compromised devices and spread more payloads. Similar strategies are used by the phishing campaign that researchers discovered; the only distinction is that it attaches a file (the malware) to GitHub comments before deleting them. Similar to the previously described instance, the URL is still active and is shared through phishing emails.

Due to the fact that GitHub is usually a trustworthy site, emails containing links to it can effectively get beyond SEG security. Threat actors can link to the malware archive directly from the email using GitHub links, saving them from using QR codes, Google redirects, or other SEG bypass methods.

Impact

• Security Bypass
• Unauthorized Access

Remediation

• Never trust or open links and attachments received from unknown sources/senders.
• Implement multi-factor authentication to add an extra layer of security to login processes.
• Regularly monitor network activity for any unusual behavior, as this may indicate that a cyberattack is underway.
• Organizations need to stay vigilant and follow best practices for cybersecurity to protect their systems and data from potential threats. This includes regularly updating software and implementing strong access controls and monitoring tools.
• Develop a comprehensive incident response plan to respond effectively in case of a security breach or data leakage.
• Maintain regular backups of critical data and systems to ensure data recovery in case of a security incident.
• Adhere to security best practices, including the principle of least privilege, and ensure that users and applications have only the necessary permissions.
• Establish a robust patch management process to ensure that security patches are evaluated, tested, and applied promptly.
• Conduct security audits and assessments to evaluate the overall security posture of your systems and networks.
• Implement network segmentation to contain and isolate potential threats to limit their impact on critical systems.