{"id":58260,"date":"2025-03-06T17:00:00","date_gmt":"2025-03-06T17:00:00","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/malvertising-campaign-leads-to-info-stealers-hosted-on-github\/"},"modified":"2025-03-06T17:00:00","modified_gmt":"2025-03-06T17:00:00","slug":"malvertising-campaign-leads-to-info-stealers-hosted-on-github","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/malvertising-campaign-leads-to-info-stealers-hosted-on-github\/","title":{"rendered":"Malvertising campaign leads to info stealers hosted on GitHub"},"content":{"rendered":"

In early December 2024, Microsoft Threat Intelligence detected a large-scale malvertising campaign that impacted nearly one million devices globally in an opportunistic attack to steal information. The attack originated from illegal streaming websites embedded with malvertising redirectors, leading to an intermediary website where the user was then redirected to GitHub and two other platforms. The campaign impacted a wide range of organizations and industries, including both consumer and enterprise devices, highlighting the indiscriminate nature of the attack.<\/p>\n

GitHub was the primary platform used in the delivery of the initial access payloads and is referenced throughout this blog post; however, Microsoft Threat Intelligence also observed one payload hosted on Discord and another hosted on Dropbox.<\/p>\n

The GitHub repositories, which were taken down, stored malware used to deploy additional malicious files and scripts. Once the initial malware from GitHub gained a foothold on the device, the additional files deployed had a modular and multi-stage approach to payload delivery, execution, and persistence. The files were used to collect system information and to set up further malware and scripts to exfiltrate documents and data from the compromised host. This activity is tracked under the umbrella name Storm-0408 that we use to track numerous threat actors associated with remote access or information-stealing malware and who use phishing, search engine optimization (SEO), or malvertising campaigns to distribute malicious payloads.<\/p>\n

In this blog, we provide our analysis of this large-scale malvertising campaign, detailing our findings regarding the redirection chain and various payloads used across the multi-stage attack chain. We further provide recommendations for mitigating the impact of this threat, detection details, indicators of compromise (IOCs), and hunting guidance to locate related activity. By sharing this research, we aim to raise awareness about the tactics, techniques, and procedures (TTPs) used in this widespread activity so organizations can better prepare and implement effective mitigation strategies to protect their systems and data.<\/p>\n

We would like to thank the GitHub security team for their prompt response and collaboration in taking down the malicious repositories.<\/p>\n

GitHub activity and redirection chain<\/h2>\n

Since at least early December 2024, multiple hosts downloaded first-stage payloads from malicious GitHub repositories. The users were redirected to GitHub through a series of other redirections. Analysis of the redirector chain determined the attack likely originated from illegal streaming websites where users can watch pirated videos. The streaming websites embedded malvertising redirectors within movie frames to generate pay-per-view or pay-per-click revenue from malvertising platforms. These redirectors subsequently routed traffic through one or two additional malicious redirectors, ultimately leading to another website, such as a malware or tech support scam website, which then redirected to GitHub.<\/p>\n

Multiple stages of malware were deployed in this campaign, as listed below, and the several different stages of activity that occurred depended on the payload dropped during the second stage.<\/p>\n