Security News > 2022 > October > Thousands of GitHub repositories deliver fake PoC exploits with malware

Thousands of GitHub repositories deliver fake PoC exploits with malware
2022-10-23 15:15

Researchers at the Leiden Institute of Advanced Computer Science found thousands of repositories on GitHub that offer fake proof-of-concept exploits for various vulnerabilities, some of them including malware.

GitHub is one of the largest code hosting platforms, and researchers use it to publish PoC exploits to help the security community verify fixes for vulnerabilities or determine the impact and scope of a flaw.

According to the technical paper from the researchers at Leiden Institute of Advanced Computer Science, the possibility of getting infected with malware instead of obtaining a PoC could be as high as 10.3%, excluding proven fakes and prankware.

The report contains a small set of repositories with fake PoCs that delivered malware.

Malware in the PoC. By looking closer into some of those cases, the researchers found a plethora of different malware and harmful scripts, ranging from remote access trojans to Cobalt Strike.

The script is the Houdini RAT, an old JavaScript-based trojan that supports remote command execution via the Windows CMD. In another case, the researchers spotted a fake PoC that was an info-stealer collecting system information, IP address, and user agent.


News URL

https://www.bleepingcomputer.com/news/security/thousands-of-github-repositories-deliver-fake-poc-exploits-with-malware/

Related vendor

VENDOR LAST 12M #/PRODUCTS LOW MEDIUM HIGH CRITICAL TOTAL VULNS
Github 12 2 45 29 19 95