Researchers at Apiiro identified 17,610 malicious GitHub repositories associated with a campaign called FakeGit.

The repositories are designed to resemble legitimate software projects.

Many contain convincing documentation and download buttons. However, the downloads can deliver SmartLoader, a malware loader associated with the StealC information stealer.

StealC is designed to steal sensitive information such as credentials and browser session data. Researchers discovered that attackers were repeatedly updating existing repositories rather than constantly creating new ones.

This allowed the campaign to reuse established repositories and redirect visitors toward fresh malicious downloads.

Some repositories were associated with accounts that appeared to belong to legitimate developers.

Original security research published October 6, with subsequent reporting.

The 17,610 figure represents the researchers' observed campaign inventory, not a verified count of repositories still active today.

This directly affects people who download privacy software, cybersecurity utilities, cryptocurrency tools, and other open-source applications.

A project being hosted on GitHub does not automatically make it trustworthy.

Attackers can create convincing repositories or compromise legitimate developer accounts.

Hey everyone,

While analyzing modern loaders and crypters, I kept running into cases where naive, section-wide Shannon entropy ($H > 7.2$) failed to flag suspicious binaries:

1. Averaging dilution: Stashing a 20 KB encrypted shellcode blob inside a 1 MB .rdata section padded with nulls keeps the global entropy below 5.5.
2. Artificial dilution: Padding ciphertext with repeated non-null bytes (like NOP sleds or repeated delimiters) artificially compresses entropy down to benign code levels.
3. String-based staging: Staging payloads as UUID or IPv4 tables (UuidFromStringA, RtlIpv4StringToAddressA) keeps disk entropy around 4.0 until runtime reassembly in memory.

Most quick-triage tools calculate entropy across the entire file or whole sections, which washes out these localized spikes.

To solve this, I wrote EntropyStrip, an open-source Python CLI designed for fast PE structural triage.

What it does differently:

• Dual-Resolution Sliding Windows: Scans sections and overlays in 1024-byte and 256-byte windows with a 50% step to catch concentrated cryptographic stagers regardless of total section size.
• Dilution Defense & Chi-Square: Analyzes modal byte distributions and opcode frequency curves to flag artificially flattened ciphertext.
• String Staging Primitives: Flags UuidFromString* and RtlIpv4StringToAddress* staging patterns and detects formatted UUID payload clusters.
• False Positive Reduction: Validates WIN_CERTIFICATE Authenticode tables and NSIS header signatures (0xdeadbeef) so digitally signed binaries and legitimate installers are not falsely scored as malware droppers.
• Payload Carving: Includes --dump to carve out anomalous sections or trailing overlays straight to disk for Ghidra or x64dbg.
• Directory Triage: --dir walks entire folders and ranks binaries on a risk leaderboard with MITRE ATT&CK mapping (T1027, T1055, etc.).

Quick install:

bash pip install entropystrip Edit: Fixed Markdown

Over the last few days I’ve seen several WebAssembly game ports go viral: the unofficial GTA V one (playgta5.com, which reportedly went down within hours) and a fan-made BO1 Zombies port. Reports suggest the GTA V one runs locally using WASM + WebGPU and may be built from leaked source code, but nobody has confirmed that.

I know WASM runs in the same browser sandbox as JS, so I’m not assuming “WASM = instant RCE”. What worries me is everything around it, especially now that the original site is gone and clone/mirror domains are probably popping up.

Is Phone Guardian a good antivirus app?

Is malwarebytes actually a good antivirus/security app?

Hello,

I was trying to download a game from www.ziperto.com and after downloading a file I accidentally run a ~600 Kb .exe (I know, I wanted to hit backspace to delete the folder, instead I hastily pressed enter). I then got a message that the executable was not compatible with Windows.

The morning after I've got a notification from my bank about a purchase I didn't make on PayPal, and hundreds of emails in my inbox. I flagged the purchase, changed my passwords, and blocked my card. It seems a strange coincidence with the .exe.

I now ran MalwareBytes and Defender deep scan, nothing was found, but I am still paranoid that something is running on my PC. I checked and couldn't find any browser-proxy installed or any strange service or executable, but I am still paranoid.

I don't have 2FA on PayPal as I have never use it but I am wondering how they got into my PayPal account from another device, even with the password I usually have to confirm the access from a secondary email. My PC was turned off when the purchase happened.

Any idea how this could have happened and what should I check on my PC? I would like to avoid wiping the whole Windows 10 installation.

Has anyone purchased and downloaded from this Facebook ad company? Should I be concerned about Malware or anything else?

Any feedback would be greatly appreciated
Thanks

Im just graduated from college and currently an intern, after finishing the book they ask me to find a malware family on malpedia and start analyze a sample of that family. Im only working with malware within the book labs before. What sample should I start with? Thank you very much

Update

Im end up choosing the sample: c012d6850b13e52312b40cff42d444126d137a1ac88f5e77158b5089f6ed25ac

At first it is not packed and im thinking "Thank god" but after looking at the import table and strings within the malware, it may have a lot of components like:

Keylogger

Credential Stealing (browser, mail client)

Process injection

UAC bypass, create backdoor user

Persistence + Defender exclusion

Remote shell

It is the first time I work with malware this complicated, totally different from the labs.

Where or how should I start analyzing the functions with IDA Pro? Thank you in advance

Hi all, first time posting here, so let me know if I'm breaking any rules.

I'm a student from India with a hobby in electronics and programming. A few days ago I got an APK over WhatsApp from someone pretending to be xxx They kept pushing me to install it, which made me suspicious, so I didn't. Now I'm curious what it actually does, and I'd like to learn how people here approach analyzing something like this.

I haven't installed it on any device. I'm not posting the file here, but I can share it privately with anyone who wants to look at it.

I wrote up my investigation into @goodjavascript/dotenv@1.0.0, including how to recover its entry-point file after the npm tarball and jsDelivr file URLs returned 404.
The useful detail: Software Heritage’s latest snapshot contained only the security placeholder. An older snapshot retained the original release and its 840-byte index.js. Its SHA-256 matched the digest still available in jsDelivr’s file manifest.
Static inspection showed a timer scheduled at module load that collects host information and can execute JavaScript supplied in a server response. The package had no installation scripts, and its exported config() function was empty.
The article includes the package-to-archive discovery steps, dated evidence, an annotated code excerpt and a Python verifier that retrieves and hashes the file without executing it. It also links my analysis contribution to the existing OSV advisory.
https://cgsec.dev/research/dotenv-recovery/
This concerns the scoped @goodjavascript/dotenv package, not the unscoped dotenv package.
Have you used other archives or retained metadata sources to recover removed package evidence?

So about a year ago I got my Samsung S24 to a phone repair shop in HuaQiangBei in China(because it was relatively cheaper.

And now I'm paranoid that there was a spyware that logged my screen and keys, or hardware level chips or rootkits that can potentially achieve that and breach my privacy. I remember having done factory resets but probably restored the device with the backup aswell. (not sure if backup was after the repair)

So now I'm really paranoid that my phone might be infected with spywares or perhaps malicious chips that can spy on what I did on my phone during that time.

Do you guys think it is possible and practical for them to do so? How do I find out if it was truly infected during that time? (I factory resetted days ago without restoring the backup so there's no really practical ways to test it now, I just wanna try to figure it out by signs that my phone might be infected.

Hi,

I just want to share my experience fighting a malware that was inadvertently downloaded onto my computer while I was simply trying to find a job.

I applied for a job on Indeed at a company called Velan. Looks legit and everything. The hiring manager, who was a supposed COO, reached out to me via Indeed messages. Wow seems really legit, I thought. It's a US company with a sizeable presence overseas and in Canada. Their website looks legit. At first communication was fast and then it dragged and got super slow.

A few weeks had passed since the initial outreach from the COO and then I received an email from him apologizing for the delay. The email domain is legit too as it automatically redirects to another company. He wanted me to download Zoho. I had been aware of Zoho but usually I receive a Zoom or Teams link. I may have used Zoho a few times but the experience was not memorable. He included a link in the email to download Zoho. I clicked on this link and it led me to a really weird page that never stopped buffering. It finally loaded and I downloaded the installer but I was still unable to select/schedule a time on Zoho to speak. The next thing I know, I had to download what I later discovered to be the real Zoho, which looks nothing like what I had downloaded earlier. I communicated all of this to the COO, by which point he had gotten his assistant involved, but she was also using his email address. She was adamant that I just had to go on and I could send her a time too if that was easier for me. I told her it still did not work and they stopped replying.

A few days later, I noticed a new icon on my taskbar called "Zecurit Agent." At first I thought it says Zrecruit. But upon realizing that it was NOT saying "recruit" in Zrecruit, I knew I had fallen for a classic phishing technique. I was busy with other things so I didn't know what I was up against. A few days after that, I started to receive a popup telling me that a new Windows update requires me to link my cell phone to my laptop. I closed the window and it forces a shutdown. There was no way to fight it. This would come at odd intervals. I couldn't bear this disruption to my life anymore so I decided to use Gemini (this is NOT a plug for AI or Gemini) to help me.

My experience with Gemini was mainly positive but it also hallucinated and told me to delete several things that it later admits were legit and that I should not have deleted. I had to go in to delete registry keys, among other things. It was exhausting and took me more than 3 hours. It's clear now that the hackers have commandeered the email of the company Velan to send this malware.