6 ms·

A repository search shows 2.2K repos with the text "A Mini Shai-Hulud has Appeared", all created within the past day: https://github.com/search?q=A%20Mini%20Sh

• spate141 5mo ago
  what's this all about?
  • foo12bar 5mo ago
    FTFA > The attack steals credentials, authentication tokens, environment variables, and cloud secrets, while also attempting to poison GitHub repositories.
    • CodeAndCuffs 5mo ago
      That doesn't really explain why there is a bunch of GitHub repos created as well. If I remember correctly from Shai-Hulud 2, the attacker extricated creds by posting them in public github repos with minor easily reversible encryption. I believe it was double b64 last time. I'm assuming the logic there is that every security researcher and company is going to pull and scan those creds for their stuff and their clients' stuff. So the attacker is just 1 of N people downloading it. As opposed to trying to send it to their own machine directly.
      • arsome 5mo ago
        I think it's more about convenience and bypassing filters - developers are already logged in to github, already have access to create repos and publish code, firewalls will allow it. Even fancy HIDS systems will think the git push is rather normal. If they have a clue, the attacker still will not download that without using a botnet tunnel or Tor at a minimum. Note though that these credentials aren't even encrypted using some lightweight ECC to prevent others from capturing them, they're posted in cleartext. Embarassment might be part of the point.
      • i_think_so 5mo ago
        [dead]
      • bbor 5mo ago
        With HN ettiquette in mind, I must make an exception: this is a case where skimming the first parts of the article would help a lot! The public repo path is just one of four parallel paths, with the goal of getting around any barriers: The exfiltration component shares its design with the "Mini Shai-Hulud" mechanism from their last campaign, using four parallel channels so stolen data gets out even if individual paths are blocked.
  • progbits 5mo ago
    Malware uploading the credentials it managed to steal
• rhdunn 5mo ago
  The repository names all look like two terms/words from dune (harkonen, mentat, ornithoptor, etc.) followed by a number. This would indicate that the account (possibly GitHub auth/actions token) has been compromised and then used to create the repository.
• avaer 5mo ago
  Why can't GitHub get on the case and just block any repo where the README matches the regex? I thought they'd have learned their lesson the last time it happened. This malware isn't even trying. Then again it's Microsoft so they're not even trying either.
  • eddythompson80 5mo ago
    6 minutes later an HN submission "GitHub blocks your account if you mention X in the README" with a top comment "This is absurd, are they just doing regex matching to check for malware?"
  • sgskinner 5mo ago
    “Some people, when confronted with a problem, think ‘I know, I’ll use regular expressions.’ Now they have two problems.”
    • i_think_so 5mo ago
      [dead]
  • bbor 5mo ago
    1. This happened less than 24 hours ago. 2. This is just one of the four techniques the worm uses to phone home.
• ramon156 5mo ago
  https://github.com/tinin46 https://github.com/tinin46 this account seems to store a lot of keys, not sure what theyre for