Malvertising Campaign Exploits GitHub to Distribute Info-Stealing Malware

In December 2024, Microsoft Threat Intelligence uncovered a large-scale malvertising campaign that compromised nearly one million devices worldwide. The attack primarily targeted users visiting illegal streaming websites, redirecting them through a series of malicious sites before landing on GitHub, where the malware was hosted.

Attack Chain and Methodology

The sophisticated multi-stage attack began with users accessing illegal streaming platforms embedded with malvertising redirectors. These redirectors led users through intermediary websites, ultimately pointing them to GitHub repositories containing the initial malware payloads.

Once executed, these payloads performed system reconnaissance and deployed additional malicious software, including information stealers like Lumma and an updated version of Doenerium. The attackers also utilized legitimate tools such as NetSupport, a remote monitoring and management software, to maintain persistent access.

Scope and Impact

The campaign’s indiscriminate nature affected a broad spectrum of organizations and industries, impacting both consumer and enterprise devices. The use of trusted platforms like GitHub for malware distribution underscores the evolving tactics of cybercriminals and the challenges in detecting such threats.

Recommendations and Mitigation

To mitigate the risks associated with such attacks, organizations and individuals are advised to:

• Exercise Caution: Avoid visiting illegal streaming sites or downloading content from untrusted sources.
• Implement Security Measures: Utilize reputable security software and ensure it is regularly updated to detect and prevent malware infections.
• Educate Users: Conduct regular training sessions to raise awareness about the dangers of malvertising and the importance of safe browsing habits.

By staying vigilant and adopting proactive security practices, users can protect themselves against such sophisticated cyber threats.