NEWS How to Trick a Hacker? Give Them a Malicious Exploit with Thousands of Commits

[ExcalibuR]

How to Trick a Hacker? Give Them a Malicious Exploit with Thousands of Commits​

​

When a repository is a Trojan, and commits are just smoke and mirrors for installing a stealer.

A recently uncovered malware campaign is using GitHub as a trap for security researchers, gamers, and even other hackers—distributing malicious code disguised as utilities, cheats, and exploits. Behind seemingly harmless repositories lies a carefully orchestrated operation involving hundreds of projects loaded with backdoors that activate during compilation or execution.

The scale of this scheme came to light thanks to Sophos researchers, who were approached by a client investigating a remote access threat—Sakura RAT. While the RAT itself turned out to be non-functional, its Visual Studio project contained a PreBuildEvent command that automatically downloaded and installed malware on any machine attempting to compile the code.

The investigation led to a GitHub account named "ischhfd83", directly or indirectly linked to 141 repositories, 133 of which contained backdoors. What appeared to be normal coding activity was actually a deceptive ploy—tricking users into running malware under the guise of legitimate tools.

A Variety of Malicious Techniques​

The campaign employs multiple infection methods, including:

• Obfuscated Python scripts
• Malicious .scr files (disguised as screensavers)
• Encrypted JavaScript logic
• Unicode tricks to hide malicious actions
• Visual Studio automation triggering payloads without user awareness

While some repositories appear abandoned since late 2023, many remain active, with commits being pushed minutes before analysis began. These commits are fully automated, creating an illusion of active development to boost credibility. One repo had nearly 60,000 commits despite being created in March 2025—averaging 4,446 commits per project.

Evasion Tactics​

• Each repository has only three contributors.
• No more than nine projects are linked to a single account.
• This spreads attention and avoids GitHub’s automated detection.

Luring the Victims​

The attackers promote their traps via:

• YouTube videos
• Discord discussions
• Cybercrime forum posts

Sakura RAT recently gained media attention, attracting novice security enthusiasts who tried running the code—making them prime targets.

The Infection Chain​

1. Execution/compilation triggers VBS scripts.
2. PowerShell fetches an encrypted payload from a predefined URL.
3. A 7zip archive is downloaded from GitHub.
4. An Electron app ("SearchFilter.exe") runs, containing obfuscated main.js that:
   • Collects system data
   • Executes remote commands
   • Disables Windows Defender
   • Downloads additional malware
5. Final payloads include:
   • Lumma Stealer
   • AsyncRAT
   • Remcos RAT

Who’s at Risk?​

While the main targets are aspiring hackers exploring malware frameworks, the bait extends to:

• Gamers (fake game mods/cheats)
• Students (coding tools)
• Security professionals (fake pentesting utilities)

How to Stay Safe?​

Given GitHub’s open nature and lack of pre-moderation:

• Always review source code before compiling.
• Check for suspicious PreBuild/PostBuild scripts.
• Be wary of repositories with excessive commits but little real activity.

This campaign proves that even open-source platforms can be weaponized—stay vigilant!