Security News > 2022 > October > Thousands of GitHub repositories deliver fake PoC exploits with malware
Researchers at the Leiden Institute of Advanced Computer Science found thousands of repositories on GitHub that offer fake proof-of-concept exploits for various vulnerabilities, some of them including malware.
GitHub is one of the largest code hosting platforms, and researchers use it to publish PoC exploits to help the security community verify fixes for vulnerabilities or determine the impact and scope of a flaw.
According to the technical paper from the researchers at Leiden Institute of Advanced Computer Science, the possibility of getting infected with malware instead of obtaining a PoC could be as high as 10.3%, excluding proven fakes and prankware.
The report contains a small set of repositories with fake PoCs that delivered malware.
Malware in the PoC. By looking closer into some of those cases, the researchers found a plethora of different malware and harmful scripts, ranging from remote access trojans to Cobalt Strike.
The script is the Houdini RAT, an old JavaScript-based trojan that supports remote command execution via the Windows CMD. In another case, the researchers spotted a fake PoC that was an info-stealer collecting system information, IP address, and user agent.
News URL
Related news
- 390,000+ WordPress Credentials Stolen via Malicious GitHub Repository Hosting PoC Exploits (source)
- Fake LDAPNightmware exploit on GitHub spreads infostealer malware (source)
- New Malware Technique Could Exploit Windows UI Framework to Evade EDR Tools (source)
- New Glutton Malware Exploits Popular PHP Frameworks Like Laravel and ThinkPHP (source)
- Hackers Exploit Webview2 to Deploy CoinLurker Malware and Evade Security Detection (source)
- Attackers Exploit Microsoft Teams and AnyDesk to Deploy DarkGate Malware (source)
- Adobe warns of critical ColdFusion bug with PoC exploit code (source)
- Malware botnets exploit outdated D-Link routers in recent attacks (source)
- LDAPNightmare PoC Exploit Crashes LSASS and Reboots Windows Domain Controllers (source)
- Python-Based Malware Powers RansomHub Ransomware to Exploit Network Flaws (source)