GitHub’s Dark Side: Unveiling Malware Disguised as Cracks, Hacks, and Crypto Tools

Authored by Aayush Tyagi

Video game hacks, cracked software, and free crypto tools remain popular bait for malware authors. Recently, McAfee Labs uncovered several GitHub repositories offering these tempting “rewards,” but a closer look reveals something more sinister. As the saying goes, if it seems too good to be true, it probably is.

GitHub is often exploited for malware distribution due to its accessibility, trustworthiness, and developer-friendly features. Attackers can easily create free accounts and host repositories that appear legitimate, leveraging GitHub’s reputation to deceive users.

McAfee Labs encountered multiple repositories, offering game hacks for top-selling video games such as Apex Legends, Minecraft, Counter Strike 2.0, Roblox, Valorant,
Fortnite, Call of Duty, GTA V and or offering cracked versions of popular software and services, such as Spotify Premium, FL Studio, Adobe Express, SketchUp Pro, Xbox Game Pass, and Discord to name a few.

Executive summary

These attack chains begin when users would search for Game Hacks, cracked software or tools related to Cryptocurrency on the internet, where they would eventually come across GitHub repositories or YouTube Videos leading to such GitHub repositories, offering such software.

We noticed a network of such repositories where the description of software keeps on changing, but the payload remains the same: a Lumma Stealer variant. Every week, a new set of repositories with a new malware variant is released, as the older repositories are detected and removed by GitHub. These repositories also include distribution licenses and software screenshots to enhance their appearance of legitimacy.

Figure 1: Attack Vector

These repositories also contain instructions on how to download and run the malware and ask the user to disable Windows Defender or any AV software, before downloading the malware. They provide the reasoning that, since the software is related to game hacks or by-passing software authentication or crypto-currency mining, AV products will detect and delete these applications.

This social engineering technique, combined with the trustworthiness of GitHub works well in the favor of malware authors, enabling them to infect more users.

Children are frequently targeted by such scams, as malware authors exploit their interest in game hacks by highlighting potential features and benefits, making it easier to infect more systems.

Technical Analysis

As discussed above, the users would come across malicious repositories through searching the internet (highlighted in red).

Figure 2: Internet Search showing GitHub results.

Or through YouTube videos, that contain a link to the repository in the description (highlighted in red).

Figure 3: YouTube Video containing malicious URL in description.

Once the user accesses the GitHub repository, it contains a Distribution license and other supporting files, to trick the user into thinking that the repository is genuine and credible.

Figure 4: GitHub repository containing Distribution license.

Repositories also contain a detailed description of the software and installation process further manipulating the user.

Figure 5: Download instructions present in the repository.

Sometimes, the repositories contain instructions to disable AV products, misleading users to infect themselves with the malware.

Figure 6: Instructions to disable Windows Defender.

To target more children, repositories contain a detailed description of the software; by highlighting all the features included within the package, such as Aimbots and Speed Hacks, and how easily they will be able to gain an advantage over their opponents.

They even mention that the package comes with advance Anti-Ban system, so their account won’t be suspended, and that the software has a popular community, to create a perception that, since multiple users are already using this software, it must be safe to use and that, by not using the software, they are missing out.

Figure 7: Features mentioned in the GitHub repository.

The downloaded files, in most cases, were Lumma Stealer variants, but observing the latest repositories, we noticed new malware variants were also being distributed through the same infection vector.

Once the user downloads the file, they get the following set of files.

Figure 8: Files downloaded from GitHub repository.

On running the ‘Loader.exe’ file, as instructed, it iterates through the system and the registry keys to collect sensitive information.

Figure 9: Loader.exe checking for Login credentials for Chrome.

It searches for crypto wallets and password related files. It searches for a list of browsers installed and iterates through user data, to gather anything useful.

Figure 10: Loader.exe checking for Browsers installed on the system.

Then the malware connects to C2 servers to transfer data.

 Figure 11: Loader.exe connecting to C2 servers to transfer data.

This behavior is similar to the Lumma Stealer variants we have seen earlier.

Detection and Mitigation Strategies

McAfee blocks this infection chain at multiple stages:

1. URL blocking of the GitHub repository.

Figure 12: McAfee blocking URLs

2. Detecting downloaded malware.

Figure 13: McAfee blocking the malicious file

Conclusion and Recommendations

In conclusion, the GitHub repository infection chain demonstrates how cybercriminals exploit accessibility and trustworthiness of popular websites such as GitHub, to distribute malware like Lumma Stealer. By leveraging the user’s desire to use game hacks, to be better at a certain video game or obtain licensed software for free, they trick users into infecting themselves.

At McAfee Labs, we are committed to helping organizations protect themselves against sophisticated cyber threats, such as the GitHub repository technique. Here are our recommended mitigations and remediations:

1. Children are usually the prime targets for such scams, it is important to educate the young ones and teach them how to avoid such fishy websites.
2. Conduct regular training sessions to educate users about social engineering tactics and phishing schemes.
3. Install and maintain updated antivirus and anti-malware software on all endpoints.
4. Use network segmentation to limit the spread of malware within the organization.
5. Ensure all operating systems, software, and applications are kept up to date with the latest security patches.
6. Avoid downloading cracked software or visiting suspicious websites.
7. Verify URLs in emails, especially from unknown or unexpected sources.
8. Keep antivirus solutions updated and actively scanning.
9. Avoid downloading Game hacks or Crypto software from unofficial websites.
10. If possible, read reviews about the software you’re downloading and see what other users are saying about the malware.
11. Regularly patch browsers, operating systems, and applications.
12. Monitor the Temp folder for unusual or suspicious files.

Indicators of Compromise (IoCs)

As of publishing this blog, these are the GitHub repositories that are currently active.

Introducing McAfee+

Identity theft protection and privacy for your digital life

Download McAfee+ Now