Weekly Cyber Round-up

GitVenom campaign exploitsGitHub repositories to distribute malware and steal cryptocurrency

Kaspersky researchers discovered a new campaign, dubbed GitVenom, exploiting GitHub repositories to spread malware and stealcryptocurrency. The campaign has created hundreds of repositories on GitHub that contain fake projects with malicious code, which are used to install further payloads such as a Node[.]js stealer, AsyncRAT, the Quasar backdoor, and a clipboard hijacker. Infection attempts related to GitVenom have been observed worldwide, with the majority targeting Russia, Brazil, and Turkey. The fake projects are available in multiple programming languages, including Python, JavaScript, C, C++, and C#, and often promise functionalities like automation tools for social media or cryptocurrencymanagement. The fake projects also contained MD files, possibly generated by artificial intelligence, which contained information about the projects and instructions for users on how to compile their code.

Deceptive Development campaign uses fake job lures to target software developers

ESET researchers identified an ongoing campaign, dubbed DeceptiveDevelopment, that has been targeting freelance software developers involved in cryptocurrency and decentralised finance projects since November 2023. The campaign leverages spearphishing techniques to deliver BeaverTail and an updated version of InvisibleFerret. The malware is used to steal cryptocurrency wallets and login information, with a secondary objective of espionage. DeceptiveDevelopment operators pose as recruiters on social media to lure victims and initiate the job interview process, either by directly approaching individuals or by posting fake job listings on sites. The most common compromise vector is via a fake recruiter asking the victim to complete a project where the interviewee has to ‘fix’ a bug.

Massive botnet uses password spraying attacks to target Microsoft 365 accounts

SecurityScorecard researchers identified a botnet comprised of over 130,000 compromised devices that has been conducting large-scale password spraying attacks against Microsoft 365 users since December 2024. The attacks exploit non-interactive sign-ins with Basic Authentication, enabling logins without multi-factor authentication. Attackers are leveraging stolen credentials from infostealer logs to simultaneously target multiple accounts with one password. The researchers identified recurring IP addresses involved in communication to all attackers’ IP addresses, including one hosted at SharkTech that saw ‘rampant’ activity. In total, six C2 servers were identified, all with similar open ports and using two primary hosting providers based in China, namely CDSC-AS1 and UCLOUD HK. The campaign has been attributed to a likely Chinese-affiliated group. 

Silver Fox APT targets healthcare sector with fake Philips DICOM viewers to deliver ValleyRAT

Forescout researchers identified 29 malware samples purporting to be Philips DICOM Viewer instances. The samples deploy ValleyRAT, a backdoor malware used by the China-based advanced persistent threat (APT) actor Silver Fox. Numerous samples were submitted from the United States and Canada, suggesting an expansion in targeting by Silver Fox. The malware appears to have been updated regularly since July 2024, with the latest samples from January 2025 including multiple layers of PowerShell commands for advanced evasion. The latest samples also masquerade as the EmEditor or system drivers, in addition to Philips DICOM viewers. The compromised devices were also infected with a keylogger and cryptominer, which is behaviour not previously associated with Silver Fox.