- Github repositories are being infected with malware
- Trusted repositories can bypass secure web gateways
- Github comments are also being used to hide malicious files
In a new phishing campaign detected by Cofense Intelligence, threat actors used a novel approach by leveraging trusted GitHub repositories to deliver malware. The campaign is aimed at exploiting the inherent trust many organizations place in GitHub as a developer platform.
Instead of creating malicious repositories, attackers chose to embed malware into legitimate ones affiliated with tax organizations such as UsTaxes, HMRC, and Inland Revenue.
This allowed them to bypass Secure Email Gateway (SEG) protections, posing a significant challenge to cybersecurity defenses. The attack also capitalized on the sense of urgency tied to filing taxes after the April deadline in the US.
Phishing tactic – abuse of trusted repositories
Emails associated with the campaign contained links to archives hosted on GitHub. Unlike traditional phishing attacks that rely on suspicious links or attachments, these emails appeared credible because the GitHub repositories used were legitimate and well-known, and can circumvent Secure Web Gateways.
The archive files linked in the emails were password protected, a tactic used to add an air of legitimacy. This protection also made it more difficult for malware scanners to detect and inspect the contents of the archive. Once opened, the password-protected files installed Remcos Remote Access Trojan (RAT) on the victim’s system, granting attackers remote control over the infected device.
A key component of this campaign was the use of GitHub comments to upload malicious files. GitHub comments are typically used by developers to communicate about a repository’s content, propose changes, or document issues. However, attackers exploited this feature by uploading malware-laden files within comments rather than the repository’s source code, allowing them to circumvent the usual security protocols and ensure that the malware remained hidden.
Even if the original comment containing the malware link was deleted, the malware itself remained accessible through the repository’s file directory. This method has been used before, most notably with the Redline Stealer malware, but this campaign represents a significant escalation in the use of GitHub comments as a malware distribution vector.
The campaign primarily targeted the financial and insurance industries, with both sectors being particularly vulnerable during tax season, as they handle a large volume of sensitive financial data.
The attackers appear to have been testing the waters with a smaller campaign, focusing on these two industries. Previous phishing campaigns using techniques like QR codes had broader targets, but the narrower focus of this attack suggests the threat actors were experimenting with the GitHub-based method before scaling up.
Phishing campaigns remain one of the most persistent and effective tactics used by cybercriminals to gain unauthorized access to sensitive information.
These attacks typically involve deceptive emails or messages that trick users into clicking malicious links, downloading harmful attachments, or revealing personal details.
Over the years, phishing techniques have evolved, becoming more sophisticated and harder to detect. Cybercriminals now leverage trusted platforms, disguise malicious intent behind legitimate-looking messages, and use advanced social engineering techniques.
