This new phishing strategy utilizes GitHub comments to distribute malware

Regular security audits and updated email filtering systems could help

When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.

In a new phishing campaign detected by Cofense Intelligence, threat actors used a novel approach by leveraging trusted GitHub repositories to deliver malware. The campaign is aimed at exploiting the inherent trust many organizations place in GitHub as a developer platform.

Instead of creating malicious repositories, attackers chose to embed malware into legitimate ones affiliated withtaxorganizations such as UsTaxes, HMRC, and Inland Revenue.

This allowed them to bypass Secure Email Gateway (SEG) protections, posing a significant challenge to cybersecurity defenses. The attack also capitalized on the sense of urgency tied to filing taxes after the April deadline in the US.

Phishing tactic – abuse of trusted repositories

Emails associated with the campaign contained links to archives hosted on GitHub. Unlike traditional phishing attacks that rely on suspicious links or attachments, these emails appeared credible because the GitHub repositories used were legitimate and well-known, and can circumventSecure Web Gateways.

The archive files linked in the emails were password protected, a tactic used to add an air of legitimacy. This protection also made it more difficult for malware scanners to detect and inspect the contents of the archive. Once opened, the password-protected files installed Remcos Remote Access Trojan (RAT) on the victim’s system, granting attackers remote control over the infected device.

A key component of this campaign was the use of GitHub comments to upload malicious files. GitHub comments are typically used by developers to communicate about a repository’s content, propose changes, or document issues. However, attackers exploited this feature by uploading malware-laden files within comments rather than the repository’s source code, allowing them to circumvent the usual security protocols and ensure that the malware remained hidden.

Even if the original comment containing the malware link was deleted, the malware itself remained accessible through the repository’s file directory. This method has been used before, most notably with the Redline Stealer malware, but this campaign represents a significant escalation in the use of GitHub comments as a malware distribution vector.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

The campaign primarily targeted the financial and insurance industries, with both sectors being particularly vulnerable during tax season, as they handle a large volume of sensitive financial data.

The attackers appear to have been testing the waters with a smaller campaign, focusing on these two industries. Previous phishing campaigns using techniques like QR codes had broader targets, but the narrower focus of this attack suggests the threat actors were experimenting with the GitHub-based method before scaling up.

Phishing campaigns remain one of the most persistent and effective tactics used by cybercriminals to gain unauthorized access to sensitive information.

These attacks typically involve deceptiveemailsor messages that trick users into clicking malicious links, downloading harmful attachments, or revealing personal details.

Over the years, phishing techniques have evolved, becoming more sophisticated and harder to detect. Cybercriminals now leverage trusted platforms, disguise malicious intent behind legitimate-looking messages, and use advanced social engineering techniques.

You might also like

Efosa has been writing about technology for over 7 years, initially driven by curiosity but now fueled by a strong passion for the field. He holds both a Master’s and a PhD in sciences, which provided him with a solid foundation in analytical thinking. Efosa developed a keen interest in technology policy, specifically exploring the intersection of privacy, security, and politics. His research delves into how technological advancements influence regulatory frameworks and societal norms, particularly concerning data protection and cybersecurity. Upon joining TechRadar Pro, in addition to privacy and technology policy, he is also focused on B2B security products.

This new malware utilizes a rare programming language to evade traditional detection methods

A new form of macOS malware is being used by devious North Korean hackers

Should your VPN always be on?