Hackers Are Using Fake GitHub Code to Steal Your Bitcoin: Kaspersky

Key Points

  • GitHub projects are being used to distribute malware targeting crypto users.
  • Malicious code is hidden in seemingly legitimate projects, often with AI-generated README files.
  • The malware steals passwords, crypto wallet details, and can redirect funds to hackers' wallets.

Summary

A recent Kaspersky report highlights a growing threat on GitHub where malicious actors are planting malware within fake projects to target cryptocurrency users. Dubbed the "GitVenom" campaign, this scheme has been active for at least two years and involves creating deceptive GitHub repositories that appear legitimate, often focusing on tools like Telegram bots for managing bitcoin wallets or game-related applications. These projects come with polished README files, sometimes AI-generated, to gain trust. However, the code contains hidden malicious scripts, such as Python scripts with 2,000 tabs or rogue JavaScript functions, which execute harmful payloads. Once a system is compromised, the malware not only steals sensitive information like passwords and wallet details but also uses tools like Node.js stealers and remote access trojans to further exploit the victim's device. The attackers have managed to steal significant amounts of cryptocurrency, with one wallet alone netting 5 BTC in November. The campaign has predominantly affected users in Russia, Brazil, and Turkey, but its global reach is expanding. Kaspersky advises users to thoroughly check code before execution and to be wary of projects with overly polished documentation or suspicious commit histories.

coindesk
February 26, 2025
Crypto
Read article

Related news