GitCaught: Threat Actor Leverages GitHub Repository for Malicious Infrastructure
Essential information
- Published
- 20/05/2024 16:33
- Modified
- 20/05/2024 16:38
- Tags
- 2024-05-20
- Related entities
- 76 observables, 23 techniques (mitre), 4 malware
Description
In recent research, Recorded Future's Insikt Group uncovered a sophisticated cybercriminal campaign led by Russian-speaking threat actors from the Commonwealth of Independent States (CIS). These threat actors leveraged a GitHub profile to impersonate legitimate software applications like 1Password, Bartender 5, and Pixelmator Pro to distribute various malware types, such as Atomic macOS Stealer (AMOS) and Vidar. This malicious activity highlights the abuse of trusted internet services to orchestrate cyberattacks that steal personal information.