Fake LDAPNightmware exploit on GitHub spreads infostealer malware

[Captain Awesome]

Content source

https://www.bleepingcomputer.com/news/security/fake-ldapnightmware-exploit-on-github-spreads-infostealer-malware/

A deceptive proof-of-concept (PoC) exploit for CVE-2024-49113 (aka "LDAPNightmare") on GitHub infects users with infostealer malware that exfiltrates sensitive data to an external FTP server.

The tactic isn't novel, as there have been multiple documented cases of malicious tools disguised as PoC exploits on GitHub.

Fake LDAPNightmware exploit on GitHub spreads infostealer malware

A deceptive proof-of-concept (PoC) exploit for CVE-2024-49113 (aka "LDAPNightmare") on GitHub infects users with infostealer malware that exfiltrates sensitive data to an external FTP server.

www.bleepingcomputer.com

 

[bazang]

New words and phrases:

• Repo Stars (equivalent to Likes)
• Growth Hacking (pumping up the Repo stars to attract funding and people to the Repo)
• Fake Star Attacks (non-legitimate methods used to increase the Repo star count)

In short, it is the age-old proven method of social engineering people with Stars/Likes because people are users that want to use stuff. Predictable.

Why do the threat actors target GitHub and GitLab? Because they are the most popular and visited. Predictable.