Hackers use Github for crypto crimes
A sophisticated cyber campaign dubbed Gitvenom has been hijacking cryptocurrency wallets by embedding malicious code in seemingly legitimate open-source projects on Github, researchers report.
Kaspersky Lab’s Georgy Kucherin and Joao Godinho have traced the operation, which involves hundreds of fraudulent repositories that mimic genuine software tools, ranging from Instagram automation instruments to Telegram bots for managing Bitcoin wallets and even hacking tools for video games like Valorant, reports Bitcoin News.
Deceptive Tactics and Diverse Payloads
The threat actors behind Gitvenom have employed advanced methods to make their repositories appear authentic. They use AI-generated README files, multiple tags, and artificially inflated commit histories to boost credibility. Depending on the programming language, the attackers conceal their payloads in different ways.
For example, in Python repositories, malicious code is hidden behind long lines of whitespace followed by a script decryption command. In JavaScript projects, malware is embedded within a function that decodes and executes Base64-encoded scripts. In C, C++, and C# projects, hidden batch scripts are inserted into Visual Studio project files, ensuring that the malware executes during the build process.
Once the concealed scripts run, they download additional malicious components from attacker-controlled Github repositories. These components include a Node.js-based stealer that extracts sensitive data—such as credentials, cryptocurrency wallet information, and browsing history—sending the stolen data to attackers via Telegram. Additionally, open-source remote access tools like AsyncRAT and the Quasar backdoor are deployed, along with clipboard hijackers that replace copied crypto wallet addresses with attacker-controlled ones.
Global Impact and the Road Ahead
Active for at least two years, the Gitvenom campaign has been detected in regions including Russia, Brazil, and Turkey. Kaspersky researchers warn that as Github remains a crucial resource for millions of developers worldwide, threat actors will continue exploiting fake software projects as infection lures.
“Before attempting to run such code or integrate it into an existing project, it is paramount to thoroughly check what actions it performs,” they cautioned. As the open-source ecosystem faces these escalating threats, heightened vigilance and improved code verification practices will be essential to safeguard digital assets and maintain trust in collaborative software development.
Recently we wrote, that stablecoin neobank Infini suffered a major setback on Monday when hackers drained 49.5 million USDC from its platform, according to on-chain data.
Latest Crypto News
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
