GitHub comments abused to push malware via Microsoft repo URLs

A GitHub flaw, or possibly a design decision, is being abused by threat actors to distribute malware using URLs associated with Microsoft repositories, making the files appear trustworthy.

While most of the malware activity has been based around the Microsoft GitHub URLs, this "flaw" could be abused with any public repository on GitHub, allowing threat actors to create very convincing lures.

Abusing GitHub's file upload feature

Yesterday, McAfee released a report on a new LUA malware loader distributed through what appeared to be a legitimate Microsoft GitHub repositories for the "C++ Library Manager for Windows, Linux, and MacOS," known as vcpkg, and the STL library.

The URLs for the malware installers, shown below, clearly indicate that they belong to the Microsoft repo, but we could not find any reference to the files in the project's source code.

https://github[.]com/microsoft/vcpkg/files/14125503/Cheat.Lab.2.7.2.zip
https://github[.]com/microsoft/STL/files/14432565/Cheater.Pro.1.6.0.zip

Finding it strange that a Microsoft repo would be distributing malware since February, BleepingComputer looked into it and found that the files are not part of vcpkg but were uploaded as part of a comment left on a commit or issue in the project.

When leaving a comment, a GitHub user can attach a file (archives, documents, etc), which will be uploaded to GitHub's CDN and associated with the related project using a unique URL in this format: 'https://www.github.com/{project_user}/{repo_name}/files/{file_id}/{file_name}.'

For videos and images, the files will be stored under the /assets/ path instead.

Instead of generating the URL after a comment is posted, GitHub automatically generates the download link after you add the file to an unsaved comment, as shown below. This allows threat actors to attach their malware to any repository without them knowing.

Even if you decide not to post the comment or delete it after it is posted, the files are not deleted from GitHub's CDN, and the download URLs continue to work forever.

As the file's URL contains the name of the repository the comment was created in, and as almost every software company uses GitHub, this flaw can allow threat actors to develop extraordinarily crafty and trustworthy lures.

For example, a threat actor could upload a malware executable in NVIDIA's driver installer repo that pretends to be a new driver fixing issues in a popular game. Or a threat actor could upload a file in a comment to the Google Chromium source code and pretend it's a new test version of the web browser.

These URLs would also appear to belong to the company's repositories, making them far more trustworthy.

Unfortunately, even if a company learns their repos are abused to distribute malware, BleepingComputer could not find any settings that allow you to manage files attached to your projects.

Furthermore, you can only protect a GitHub account from being abused in this way and tarnishing your reputation by disabling comments. According to this GitHub support document, you can only temporarily disable comments for a maximum of six months at a time.

However, restricting comments can significantly impact a project's development as it will not allow users to report bugs or suggestions.

Sergei Frankoff, of automated malware analysis service UNPACME, did a livestream on Twitch about this bug just last month, saying that threat actors were actively abusing it.

Weeks later... GitHub bug still dropping malware pic.twitter.com/s165zOAsoI

— herrcore (@herrcore) March 27, 2024

As part of our research into this bug, BleepingComputer could only find one other repo, httprouter, abused to distribute malware in this way, and it was the same 'Cheater.Pro.1.6.0.zip' as seen in Microsoft's URLs.

However, Frankoff told BleepingComputer that they discovered a similar campaign in March that utilizes the same LUA loader malware, which is called SmartLoader, disguised as the Aimmy cheat software.

Frankoff told BleepingComputer that SmartLoader is commonly installed alongside other payloads, such as the RedLine information-stealing malware.

BleepingComputer contacted both GitHub and Microsoft on Thursday about this abuse but did not receive a response.

At the time of this publication, the information-stealing malware is still being distributed through links associated with Microsoft' GitHub repository.

Update 4/21/24: GitHub has removed the malware linked to Microsoft's repositories. However, the malware associated with httprouter and Aimmy are still accessible.