Fake GitHub Repositories Distribute BoryptGrab Infostealer Across 292 Repos
What Happened — Threat actors created nearly 300 counterfeit GitHub repositories that masquerade as legitimate security, crypto, and developer tools. Each repo hosts a README with a download link that redirects to a templated page delivering a ZIP containing a trojanized libcurl.dll and a signed WinGUP updater, which in turn loads the BoryptGrab infostealer. The malware harvests credentials, browser data, crypto‑wallet keys, and messaging tokens from infected machines.
Why It Matters for Compliance & Audit Readiness
- Demonstrates a supply‑chain attack vector that bypasses traditional perimeter defenses, highlighting the need for documented third‑party risk controls in a SOC 2 program.
- Continuous monitoring of external code sources provides audit‑ready evidence that your organization validates the authenticity of open‑source components before use.
- A breach of this type would trigger multiple SOC 2 Trust Service Criteria (Security, Confidentiality, and Privacy) if compromised data includes customer‑sensitive information.
Who Is Affected – Primarily technology and SaaS vendors, financial‑tech services, cryptocurrency platforms, and any organization that incorporates open‑source code from public repositories.
Recommended Actions
- Incorporate GitHub (and other code‑hosting platforms) into your vendor‑risk inventory and enforce a verification policy for any third‑party repository before integration.
- Deploy automated tooling to continuously monitor repository metadata, download URLs, and code signatures for anomalies.
- Map these checks to SOC 2 vendor‑management controls (CC6.1, CC6.2) and retain evidence of due‑diligence for audit reviewers.
Source: BleepingComputer
Technical Notes – The campaign uses a single templated HTML/JS redirector, rotating URL tokens, and a signed WinGUP updater to side‑load a malicious libcurl.dll. The BoryptGrab variant can inject code into Chrome processes to bypass App‑Bound Encryption, exfiltrating data from 19 browsers, 32 crypto wallets, and several messaging platforms. Source: [BleepingComputer]