A vast social engineering campaign dubbed "FakeGit" is exploiting the trust developers place in GitHub, leveraging over 7,600 malicious repositories to distribute infostealing malware. Identified by Sophos, the operation has resulted in more than 14 million downloads of its payload.
The attack model, detailed in a Sophos report published on May 21, is deceptively simple. Threat actors created thousands of repositories mimicking legitimate tools and projects, complete with convincing documentation. The malicious activity occurs not in the code itself, but in the project's README files and build instructions, which guide users to run commands that ultimately download and execute the malware loaders SmartLoader and StealC.
This decentralized strategy appears designed to evade traditional security scans, which typically focus on popular packages and known malicious code patterns. By spreading the risk across a wide net of low-profile repositories, each presenting a plausible façade, the campaign operated under the radar at scale.
The final payload is StealC, an infostealer programmed to harvest credentials, cryptocurrency wallets, and session tokens from compromised systems. The campaign's success, marked by millions of downloads, underscores a potent vulnerability: the human element in the software supply chain.
The incident casts a spotlight on a critical challenge for platforms like GitHub: detecting malicious intent embedded within project documentation and instructions without stifling the open collaboration that defines open-source culture. While the Sophos report details the attack's mechanics, it does not specify what remediation steps, if any, were taken by GitHub.
For developers and organizations, FakeGit serves as a critical reminder to scrutinize every command. Best practices include verifying the origin of repository instructions, using official package managers where possible, and employing script analysis tools before execution. As this campaign demonstrates, vigilance at the moment of execution is a vital defense when the very models designed to foster collaboration are turned against users.
Sophos網絡安全研究人員識別出一場名為「FakeGit」的大規模社會工程攻擊活動。該活動利用開發者對GitHub平台的信任，透過超過7,600個惡意軟件倉庫分發資訊竊取型惡意軟件，迄今已導致超過1,400萬次惡意載荷下載。
這項攻擊模式在Sophos於5月21日發布的報告中被詳細闡述，其手法看似簡單卻極具欺騙性。威脅行為者創建了數千個模仿合法工具與項目的倉庫，並配備具有說服力的說明文件。惡意活動並非直接出現在代碼中，而是隱藏於項目的README文件及建構指示中——這些指引會誘導用戶執行看似正常但實際上會下載並運行SmartLoader與StealC惡意軟件載入器的指令。
這種分散式策略顯然是為了規避傳統的安全掃描機制。由於現有掃描工具通常聚焦於熱門套件及已知的惡意代碼模式，攻擊者透過將風險分散至大量低調倉庫，並為每個倉庫偽造合理外觀，成功在維持大規模攻擊的同時避開安全偵測。
最終的惡意載荷是StealC資訊竊取程式，專門設計用於從受感染系統中竊取認證資料、加密貨幣錢包及會話權杖。該活動成功達成數百萬次下載的數據，凸顯了軟件供應鏈中一個至關脆弱的環節：人為因素。
此次事件凸顯了GitHub等平台面臨的一項關鍵挑戰：如何在不扼殺開源文化所強調的開放協作精神下，偵測嵌入於項目文件與說明中的惡意意圖。儘管Sophos報告詳細說明了攻擊機制，但並未指明GitHub方面採取了哪些補救措施。
對開發者與企業而言，FakeGit活動敲響了重要警鐘：必須審慎檢視每一個執行指令。最佳實踐包括驗證倉庫說明的來源可信度、盡可能使用官方套件管理工具，以及在執行腳本前採用代碼分析工具。正如這次攻擊所展示的，當原本用於促進協作的模式被反過來用於攻擊用戶時，在執行階段保持高度警惕就成了最重要的防線。