New Cyber Threat: GitVenom
According to the latest report from Kaspersky, a dangerous attack known as GitVenom is spreading through GitHub. This campaign, active for at least two years, continues to grow and poses a serious threat to both developers and cryptocurrency investors.
The attack starts with fake GitHub projects that appear to be legitimate tools – such as Telegram bots for managing Bitcoin wallets or utilities for PC gaming. However, these projects contain malicious code designed to steal cryptocurrencies.
How Does GitVenom Work?
Hackers use several techniques to disguise their malicious software:
🔹 Fake GitHub Projects – Fraudulent repositories present seemingly useful tools for managing crypto assets or gaming applications.
🔹 Manipulated README Files – Often generated by AI to appear trustworthy.
🔹 Trojan Horse in the Code – In Python-based scripts, attackers hide malicious code behind a string of 2,000 spaces, which decrypts and activates malware upon execution.
🔹 JavaScript-based Attacks – A rogue function is embedded in the main script, which, when executed, downloads additional malicious tools from repositories controlled by hackers.
One of the victims was a developer whose Bitcoin wallet was drained of more than $400,000 in November.
What Happens After Infection?
Once the system is compromised, the malware executes various malicious activities:
🔺 Node.js Stealer – Collects passwords, cryptocurrency wallet details, and browsing history.
🔺 Remote Access Trojan (RAT) – Tools such as AsyncRAT and Quasar allow hackers to take control of the device, log keystrokes, and capture screenshots.
🔺 Clipper Malware – Automatically replaces copied wallet addresses with hacker-controlled addresses, redirecting funds.
📌 In one case, attackers successfully stole 5 BTC (worth $485,000) in just one month!
Where Is the Threat Most Prevalent?
GitVenom has been detected most frequently in Russia, Brazil, and Turkey, but Kaspersky warns that its spread is global.
Hackers continuously update their code, imitate active development, and modify tactics to evade antivirus detection.
How to Protect Yourself?
🛑 Thoroughly inspect any code before running it!
🛑 Verify the authenticity of a GitHub project and its update history.
🛑 Be cautious of "perfectly written" README files.
🛑 Use cybersecurity protection and monitor suspicious system activities.
📢 Kaspersky warns that attacks like GitVenom are unlikely to stop and will likely evolve further. Users should remain constantly vigilant.
#HackerAlert ,
#CyberSecurity ,
#CryptoNewss ,
#HackerNews ,
#hacking Stay one step ahead – follow our profile and stay informed about everything important in the world of cryptocurrencies!
Notice:
,,The information and views presented in this article are intended solely for educational purposes and should not be taken as investment advice in any situation. The content of these pages should not be regarded as financial, investment, or any other form of advice. We caution that investing in cryptocurrencies can be risky and may lead to financial losses.“