The online platform GitHub, which specializes in software development, is popular and there is hardly a developer who is not active there – with their own projects or as an observer of other repositories. A mysterious malware network is now taking advantage of this.
The “Stargazers Ghost Network” was recently discovered by security researchers at the security company Check Point Research discovered (via Wired). They write that there are at least 3,000 phantom accounts on GitHub that spread malware or malicious links via phishing repositories. “The network consists of several accounts that spread malicious links and malware and perform other actions such as (favoriting via star), forking and subscribing to malicious repositories to make them appear legitimate,” writes Check Point. The principle is relatively simple: the more likes, i.e. GitHub stars, a repository has, the more legitimate it looks; users can also use stars to save it as quasi-bookmarks.
The main person responsible for this is said to be a group or a person that the security researchers have dubbed Stargazer Goblin. This person also disguises the malware actions by appearing legitimate or by performing “normal” actions. “The way he developed it is really clever and makes good use of the way GitHub works,” says Antonis Terefos, the person who discovered Stargazer.
The network itself is described as a sophisticated operation that functions as a “distribution as a service” (DaaS). Check Point names various malware families as malware that has been and is being distributed via Stargazer, including Atlantida Stealer, Rhadamanthys, RisePro, Lumma Stealer and RedLine. Stargazer is primarily targeting GitHub repositories that offer Windows downloads of tools for social media, games and cryptocurrencies. Stargazer Goblin offers the services in relevant forums and via Telegram; the security researchers estimate the total income of this campaign to be around $100,000.
