US Edition
100+ Backdoored Malware Repos Traced to Single GitHub User
- Sophos researchers uncovered a large-scale campaign in 2024-2025 where a developer named ischhfd83 used over 130 GitHub repositories with hidden backdoors.
- The investigation began after a Sophos client questioned the safety of Sakura RAT, a remote access trojan with a malicious PreBuild event that installs malware during compilation.
- Ischhfd83 automated thousands of fake commits across multiple accounts to simulate legitimacy, targeting gamers, hackers, students, and cybersecurity researchers with lures like cheats and fake exploits.
- Executing the compromised code initiates a complex infection sequence involving multiple stages where various malicious components—including info-stealers and remote access trojans like Lumma Stealer, AsyncRAT, along with Remcos—are deployed to perform data exfiltration and enable unauthorized system control.
- Sophos reported and helped remove most malicious repositories, but the campaign's methods remain popular and may evolve to target other groups beyond novice cybercriminals and gamers.
10 Articles
10 Articles
Hundreds of GitHub Malware Repos Targeting Novice Cybercriminals Linked to Single User
A sophisticated malware distribution campaign has weaponized over 140 GitHub repositories to target inexperienced cybercriminals and gaming cheat users, representing one of the largest documented cases of supply chain attacks on the platform. The repositories, masquerading as legitimate malware tools… Read more → The post Hundreds of GitHub Malware Repos Targeting Novice Cybercriminals Linked to Single User appeared first on IT Security News.
Hundreds of Malicious GitHub Repos Targeting Novice Cybercriminals Traced to Single User
Sophos X-Ops researchers have identified over 140 GitHub repositories laced with malicious backdoors, orchestrated by a single threat actor associated with the email address ischhfd83[at]rambler[.]ru. Initially sparked by a customer inquiry into the Sakura RAT, a supposed open-source malware touted for its “sophisticated anti-detection capabilities,” the investigation revealed a much broader and more insidious campaign. […] The post Hundreds of …
If you are looking for open source Trojans on Github, you should be careful. The projects often contain a safe backdoor. (Malware, Virus)
Coverage Details
Bias Distribution
- 100% of the sources are Center
To view factuality data please Upgrade to Premium
