A Hacker 'Ghost' Network Is Quietly Spreading Malware on GitHub

Researchers at Check Point have uncovered a clandestine network of approximately 3,000 "ghost" accounts on GitHub, manipulating the platform to promote malicious content. Since June 2023, a cybercriminal dubbed "Stargazer Goblin" has been exploiting GitHub's community features to boost malicious repositories, making them appear legitimate and popular.

Antonis Terefos, a malware reverse engineer at Check Point, discovered the network's activities, which include "starring," "forking," and "watching" malicious pages to increase their visibility and credibility. The network, named "Stargazers Ghost Network," primarily targets Windows users, offering downloads of seemingly legitimate software tools while spreading various types of ransomware and info-stealer malware.

Question

[smooth wombat]

If they found these accounts, did they remove them? Did they also examine them so they can try to recognize this type in the future?

Inquiring minds want to know.

Re: Question

[Samuel Silverstein]

I believe only GitHub can remove GitHub accounts.

Github is Git + MS social network shit tacked on

[Rosco P. Coltrane]

Just use the free Git part of it and ignore the social network garbage. The stars, followers and activity things are just pointless feel-good nonsense and gamification.

Re:

[Luthair]

If you ignore the stars its even easier for bad guys to trick you since they don't even need to bother to pretend the repository is popular.

When I'm looking at an open source project I'm not familiar with I begin with the assumption its malware. For larger projects it often impractical to do a security assessment so you're left with the heuristic of who is working on it and who else is using it.

Perhaps a verified tier?

[ctilsie242]

I wonder if GitHub needs verified tiers. For example, my GHE account is not just a paid account, but secured with a set of YubiKeys, has its own SSH and GPG keys. Of course, all those can be easily spam-created, but maybe we need to have some mechanism similar to Facebook, where it sends your address a snail mail item with a code in it, you type that in, and it confirms that the user has access to that physical address. Similar with a government ID. Maybe even tie into id.me or something similar to give

cheap joke

[JThundley]

Quietly spreading malware on Github? Must be Microsoft.

The liblzma / XZ / OpenSSH hack is a warning

[Seven Spirals]

The liblzma hack proves that the Chinese and possibly other foreign actors are definitely trying to backdoor open source. They are probably trying to backdoor commercial software inside of Microsoft or other companies, too. I'd definitely pick SolarWinds as a target or some other widely used software (WhatsUp Gold or 7zip for example). All it would take is one Fang Fang to bang and setup some lonely long-haired coder and we'd see some fairly dramatic results. It's a target rich environment.

If they can hack the government and steal the HR records for all of our government employees (21M employee OPM Hack) I'm pretty sure that backdooring some little underfunded FOSS project would be no problem. They almost pulled it off with the XZ hack and that would have been absolutely devastating. Does anyone actually think that was their first try ?

Maybe related

[pauljlucas]

An open-source project I have on GitHub occasionally gets forked by various accounts. However, AFAICT, they never do anything with the clones, i.e., they never make any of their own changes. So why do they bother cloning in the first place?

Re:

[pauljlucas]

Everywhere I wrote "clone" I meant "fork."

Re:

[shabble]

So why do they bother cloning in the first place?

In case you delete/hide your repo? Or they may want to make changes later, but not upstream them?

Re:

[pauljlucas]

Maybe. But I have occasionally checked back with some of them in several months out of curiosity: still no changes including no keeping up-to-date with my changes since.

Re:

[bubblyceiling]

I do it, so I have a copy of my own, incase the parent goes down

Re:

[pauljlucas]

But unless you routinely update it to mirror changes to the original, it quickly falls out of date (though I guess that's better than nothing).

Re:

[bubblyceiling]

There are only so many hours in the day