Malware News Malvertising campaign leads to info stealers hosted on GitHub

[nicolaasjan]

Content source

https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/

In early December 2024, Microsoft Threat Intelligence detected a large-scale malvertising campaign that impacted nearly one million devices globally in an opportunistic attack to steal information. The attack originated from illegal streaming websites embedded with malvertising redirectors, leading to an intermediary website where the user was then redirected to GitHub and two other platforms. The campaign impacted a wide range of organizations and industries, including both consumer and enterprise devices, highlighting the indiscriminate nature of the attack.

GitHub was the primary platform used in the delivery of the initial access payloads and is referenced throughout this blog post; however, Microsoft Threat Intelligence also observed one payload hosted on Discord and another hosted on Dropbox.

The GitHub repositories, which were taken down, stored malware used to deploy additional malicious files and scripts. Once the initial malware from GitHub gained a foothold on the device, the additional files deployed had a modular and multi-stage approach to payload delivery, execution, and persistence. The files were used to collect system information and to set up further malware and scripts to exfiltrate documents and data from the compromised host. This activity is tracked under the umbrella name Storm-0408 that we use to track numerous threat actors associated with remote access or information-stealing malware and who use phishing, search engine optimization (SEO), or malvertising campaigns to distribute malicious payloads.

In this blog, we provide our analysis of this large-scale malvertising campaign, detailing our findings regarding the redirection chain and various payloads used across the multi-stage attack chain. We further provide recommendations for mitigating the impact of this threat, detection details, indicators of compromise (IOCs), and hunting guidance to locate related activity. By sharing this research, we aim to raise awareness about the tactics, techniques, and procedures (TTPs) used in this widespread activity so organizations can better prepare and implement effective mitigation strategies to protect their systems and data.

We would like to thank the GitHub security team for their prompt response and collaboration in taking down the malicious repositories.

 

[Andy Ful]

Nasty thing.

Microsoft Defender Antivirus​

Microsoft Defender Antivirus detects threat components as the following malware:

• Trojan:Win64/LummaStealer
• Trojan:Win32/Malgent
• Behavior:Win32/Eldorado
• Behavior:Win32/LuammaStealer
• Trojan;PowerShell/Powdow
• Trojan:Win64/Shaolaod
• Behavior:Win64/Shaolaod

In the case of Microsoft Defender, three detections are behavioral.

 

[Vitali Ortzi]

Nasty thing.


In the case of Microsoft Defender, three detections are behavioral.

Microsoft over time has strengthen their behavioral monitoring and I would assume most rat kits should be detected by it unless you use evasion tactics

 

[Andy Ful]

Microsoft over time has strengthen their behavioral monitoring ...

It should, considering that it is the most targeted AV.

 

[bazang]

Behavior:Win64/PoundMeToo

 

[TairikuOkami]

It can be so easily blocked at multiple levels, mostly by my beloved DNS

First-stage: DNS blocking malware and TLDs
First-stage: Probably by disabling GPU features
Third-stage: DNS blocking C&C
Third-stage: Firewall blocking TCP Out
Fourth-stage: Disable WSH (VBScript)
Fourth-stage: Restricting PowerShell?
Fourth-stage: DNS blocking again
Fourth-stage: RunAsPPL set to 1

 

[Andy Ful]

It can be so easily blocked at multiple levels, mostly by my beloved DNS

First-stage: DNS blocking malware and TLDs
First-stage: Probably by disabling GPU features
Third-stage: DNS blocking C&C
Third-stage: Firewall blocking TCP Out
Fourth-stage: Disable WSH (VBScript)
Fourth-stage: Restricting PowerShell?
Fourth-stage: DNS blocking again
Fourth-stage: RunAsPPL set to 1

DNS blocking or blocking Ads in the web browser is a good idea, but it will not block many attacks.
I think combining many security layers (including DNS blocking) is welcome. For example, this attack can be blocked in the "Third Stage" by blocking PowerShell and CMD scripts. Enabling good Network Protection can also block/mitigate many such attacks.