GitHub Impersonation Deploys Information Stealer
Source AlienVault OTX General
Description
An internal security operations team identified a fraudulent GitHub page impersonating a cybersecurity vendor to target customers and the general public. The malicious page appeared legitimate by referencing authentic services and operational requirements. While the GitHub page itself contained non-malicious content, a disguised link led victims to download a ZIP archive containing malicious executables. The attack chain deployed BoryptGrab Stealer information-stealing malware through DLL side-loading techniques. Investigation revealed nearly 300 similar repositories impersonating well-known organizations including Malwarebytes, Bitdefender, and 360 Total Security, using SEO keywords to attract victims. The malicious page has been removed and detection capabilities have been enhanced.
Indicators of compromise
URLs 4
- https://bentleyvazquezpvey.github.io/.github/
- https://github.com/Arctic-Wolf-Security
- https://github.com/antivirus-free-bitdefender
- https://github.com/malwarebytes-protection