Researchers say criminals are cloning popular GitHub repositories for AI tools and developer resources, then quietly changing installation instructions to deliver an infostealer. The pages look legitimate (including original contributors), which lures developers into downloading and running a ZIP that launches a malware loader. The campaign has hit organizations across multiple regions, with financial services, banking, and technology most affected.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You’re on GitHub, grabbing a “Claude / ComfyUI helper tool, quick installer.” Looks legit, original contributor and all. But this is a cloned repo. The attacker quietly swapped the install steps so your “dependencies” are a ZIP with lua51.dll, compiler.exe, Application.bat, and gc.txt that drops an infostealer. Here’s the twist: despite its name, compiler.exe is just a renamed LuaJIT interpreter. When Application.bat runs it, a loader phones home through the Polygon blockchain, pulling fresh malware without ever updating the repo. Next time a GitHub AI helper says “download the latest ZIP and run Application.bat,” stop and compare those install steps against the project’s official releases before you run anything.
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Kaspersky reports an active OkoBot malware campaign targeting Windows users who manage cryptocurrency. Victims are lured via “ClickFix” fake-error pages that trick them into running PowerShell commands, and via GitHub repos posing as legitimate software downloads. The malware then steals wallet…
Researchers reported a real malvertising campaign where ads on Meta platforms promoted a fake TV-streaming app to Spanish-speaking users, leading them to sideload an Android app. After victims approved a chain of permissions (including Accessibility), the StreamRat trojan could remotely control the…
Researchers report that the WeedHack malware campaign is still infecting people through convincing fake Minecraft client/mod websites, even after its command-and-control server was disrupted. Attackers use SEO poisoning and trusted community platforms (like Discord and Minecraft modding sites) to…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
