GitVenom attacks abuse hundreds of GitHub repos to steal crypto

A malware campaign dubbed GitVenom uses hundreds of GitHub repositories to trick users into downloading info-stealers, remote access trojans (RATs), and clipboard hijackers to steal crypto and credentials. According to Kaspersky, GitVenom has been active for at least two years, targeting users globally but with an elevated focus on Russia, Brazil, and Turkey. "Over the course of the GitVenom campaign, the threat actors behind it have created hundreds of repositories on GitHub that contain fake projects with malicious code – for example, an automation instrument for interacting with Instagram accounts, a Telegram bot allowing to manage Bitcoin wallets, and a hacking tool for the video game Valorant," describes Kaspersky's Georgy Kucherin. One of the malicious GitHub repositories Source: Kaspersky The researcher explains that the fake repositories are crafted with care, featuring details and appropriately written readme files, likely with the help of AI tools. Moreover, the threat ... Read full article.