Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Software Supply Chain Security. Show all posts
StealC Malware
AI Security FakeGit Campaign GitHub malware MCP Servers SmartLoader Malware Software Supply Chain Security StealC Malware

FakeGit Malware Campaign Abuses GitHub Repositories and AI Tools

 

There has been an extensive malware campaign, dubbed FakeGit, that utilizes thousands of counterfeit GitHub repositories to distribute SmartLoader malware, which is increasingly targeted at exploiting artificial intelligence (AI) tools and Model Context Protocol (MCP) servers in order to distribute the malware. 

Researchers at Island have discovered that approximately 7,600 malicious GitHub repositories have been constructed by using approximately 6,600 false developers profiles, creating nearly 7,600 malicious GitHub repositories. 

Thousands of repositories are masquerading as AI skills or MCP servers, offering integration with services such as Google Mail, WhatsApp, Docker, Jenkins, and Databricks. It is believed that FakeGit is an evolution of a previous malware operation that was previously associated with Water Kurita and that used Lumma Stealer. 

Research by Island researchers indicates that in March 2026, the campaign began focusing on artificial intelligence-based repositories, peaking in April with hundreds of repositories impersonating artificial intelligence tools before expanding into a broader ecosystem of fake AI agents, workflows, and MCP servers. By copying code, creating convincing README files, and impersonating developer identities, the fake repositories are very closely resembling legitimate open-source projects. 

A multi-stage infection chain is triggered by the download of malicious ZIP archives. Upon activation, the attack launches a LuaJIT-based loader that launches an obfuscated Lua script to install SmartLoader. SmartLoader establishes persistence on the compromised system and launches StealC, a malicious program capable of harvesting sensitive data from infected devices once it has been activated. 

After installation, SmartLoader creates persistence using scheduled tasks, retrieves its C2 server using the Polygon blockchain smart contract, downloads encrypted payloads hosted on GitHub, and ultimately deploys the StealC information stealer by deploying the C2 server. A new advanced tactic, AgentBaiting, has also been identified, which highlights how AI-powered coding assistants and autonomous agents can unintentionally aid hackers in gaining control of a computer. 

By optimizing fake repositories, threat actors can provide users with legitimate resources instead of forcing them to visit malicious links. Research conducted by Island researchers demonstrated that Claude Code automatically replicated malicious repositories and downloaded the associated files onto a test system, resulting in the discovery and recommendation of legitimate resources by AI models searching for free AI skills or MCP servers. 

In spite of this, the AI assistant detected suspicious indicators before executing the payload, which suggests that even though AI agents can be manipulated into retrieving malicious content, they may still be capable of detecting threats later on during the execution phase. In spite of the fact that these limited tests were not intended to measure the overall detection capabilities of artificial intelligence coding assistants, Island research demonstrated that AI assistants, such as Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT, could detect malicious repositories during routine searches in response to user requests. 

Through artificial intelligence-assisted discovery processes, attackers can potentially pass malicious installation instructions to users without direct human interaction. More than 14 million downloads were recorded between the 335 malicious release assets hosted in approximately 211 FakeGit repositories as a result of GitHub's public statistics. 

In analyzing this figure, researchers cautioned that it represents cumulative download requests, including automated activity, and should not be interpreted as a count of successful infections. According to security experts, FakeGit illustrates how trust in open-source ecosystems and AI-assisted software discovery can be exploited without directly compromising any platforms. 

It is more common for attackers to distribute malware through convincing branding, fictitious developer identities, and public registries. To prevent malicious code from entering development environments, organizations should verify repository publishers, evaluate AI skills and MCP servers in isolated environments before deployment, maintain approved catalogs of trusted AI plugins, and monitor AI-assisted workflows to ensure that they are not compromised. 

A number of the fake repositories were also observed to be more credible by using duplicate project descriptions, fabricating star ratings and fork counts, and impersonating legitimate developer identities, as well as impersonating legitimate developers. In this manner, malicious projects were significantly more likely to be trusted and downloaded by developers and AI-assisted coding tools. 

AI agents are increasingly involved in the discovery and deployment of software, but researchers warn that the security of these automated workflows is as important as ensuring that human users are protected from traditional social engineering attacks. Using trusted developer platforms and AI-assisted workflows, cybercriminals are adjusting to the AI era through the FakeGit campaign. 

The increasing reliance on AI tools and open-source repositories calls for verification of software sources, limiting untrusted AI integrations, and strengthening supply chain security.
Read more »
Software Supply Chain Security
AI Coding Agents AI Security Agents Claude Code Cyber Security Malicious Code Execution OpenAI Codex Prompt Injection Attack Software Supply Chain Security

AI Agents Built to Detect Malware Can Be Manipulated Into Running It


 

AI agents capable of identifying malicious software can be manipulated by the AI Now Institute to execute it, according to new research. The proof-of-concept attack, known as "Friendly Fire," demonstrates that autonomous AI coding agents, such as Claude Code from Anthropic and Codex from OpenAI, can be deceived into running malicious code while performing open-source security reviews. 

AI agents can approve and execute commands independently of the user without requiring user confirmation for every action, which is what this attack targets. Researchers contend that the vulnerability does not lie in the software version used by these agents, but rather in the way they interpret and react to instructions embedded within untrusted repositories rather than exploiting a software vulnerability. 

A comparison with conventional supply-chain attacks that hide malicious code within a repository was made by the researchers, who noted that when static analysis and manual review are performed, the repository itself can appear to be completely free of malicious code. By introducing the malicious payload at execution time, the AI agent follows embedded instructions, so traditional security tools cannot detect this technique.

By adding a seemingly harmless README.md instruction to an open-source project that recommended running a script entitled security.sh before submitting a pull request, attackers modified it. By launching a malicious binary hidden within a legitimate compiled Go file, the script silently executed on the host computer without triggering security warnings or approval prompts, allowing the malicious binary to execute on the system. 

According to the researchers, the attack is successful because the AI agent recognizes the instructions as a legitimate step in the process of installing software rather than an attempt to exploit the system maliciously. Once the recommended script has been executed, the payload will run under the same permissions that were provided for the developer or AI agent, potentially exposing credentials, environment variables, and other sensitive information. 

The procedure differs from previous prompt injection attacks, which relied on configuration files and often generated trust warnings, as this technique hides instructions inside standard documentation that is regularly read by developers and AI agents. It has been reported that both Claude Code and OpenAI Codex followed the embedded instructions during testing, while newer AI models executed the disguised binary upon detecting differences between the source file and the compiled executable. 

A laboratory proof-of-concept has been demonstrated, with no evidence of active exploitation in the field. In addition to excluding the malicious payload, the publicly released demonstration code does not attempt privilege escalation or lateral movement. These findings indicate that autonomous AI agents pose a greater challenge in terms of design rather than a problem that can be resolved by simply updating software. 

It is becoming more common for organizations to employ AI-powered coding assistants to review third-party software. Researchers recommend treating AI coding agents as privileged software, rather than simply assistants. Autonomous agents should not be permitted to execute commands on untrusted repositories, least-privilege access policies should be enforced, AI workflows should be isolated in sandboxed environments, and human approval should be required before running scripts or binaries recommended by project documentation. 

In accordance with the researchers, the issue is not related to any particular AI model, but a broader trust problem affecting autonomous coding assistants capable of executing shell commands. In addition to creating new attack surfaces if they are unable to reliably distinguish legitimate instructions from content controlled by the attacker, AI agents are becoming increasingly capable of cloning repositories, installing dependencies, and resolving setup issues independently. 

As autonomous AI systems are increasingly adopted in the software development and cybersecurity sectors, prompt injection attacks remain a major security threat. This study adds to a growing body of evidence that prompt injection attacks remain one of the greatest security risks. In light of the increasing autonomy of AI agents, organizations must balance automation and strong oversight in order to balance automation and security workflows. 

AI-driven attack techniques cannot be effectively countered until artificial intelligence (AI) systems can reliably discriminate between trusted and malicious instructions. Human verification and secure execution environments will therefore remain critical safeguards.
Read more »
TeamPCP
CI CD Security Cloud Credential Theft Cyber Threats Dependency Attacks Open Source Security Shai Hulud Malware Software Supply Chain Attack Software Supply Chain Security TeamPCP

TeamPCP Exposes the Hidden Risks of Software Development’s Speed Culture


Software industry companies have emphasized development velocity as a competitive advantage for years, streamlining release cycles, automating deployments, and increasingly utilizing sprawling open-source ecosystems to accelerate innovation as a competitive advantage. However, a recent campaign orchestrated by TeamPCP has revealed the security debt underpinning that speed-first approach.

Within a short period of time, the threat actor compromised more than 1,000 software packages and weaponized trusted development channels, showing the reliance on assumptions rather than verification that modern software supply chains have in place. The most recent escalation occurred following the public release of the Shai-Hulud worm's source code, a malicious tool previously used in numerous supply chain intrusions, along with operational guidance aimed at encouraging broader misuse. 

Through open distribution of the malware and promotion of a reward-driven "supply chain challenge," TeamPCP has demonstrated its ability to shift the threat from a single adversary to a potentially broader ecosystem threat. There is a growing reality for software developers, enterprises, and security teams alike that this development emphasizes: the greatest vulnerability in modern software development is not necessarily a flaw in the code itself, but rather a trust placed in repository repositories, dependencies, and automated workflows. 

A key component of TeamPCP's campaign is the ability to weaponize vulnerabilities already embedded within modern software development practices rather than developing new malware and previously unknown exploitation techniques. With organizations accelerating release cycles through automated continuous integration/continuous delivery pipelines and increasingly integrating artificial intelligence-driven coding assistants, trust decisions are making more frequently without meaningful human verification.

The security research community notes that this environment has created a fertile ground for supply chain abuse, in which unvetted packages, compromised dependencies, and stolen publisher credentials are able to move through development workflows at unprecedented speed. TeamPCP demonstrates exactly how a single compromise within a trusted distribution channel can have an impact on thousands of downstream users through a single breach. 

In the process of conducting the attacks, the group has highlighted a long-standing industry concern: although software packages are often thoroughly tested before deployment, identities, credentials, and publishing environments that distribute those packages are usually less scrutinized. It is believed that much of TeamPCP activity may be attributed to a small group of operators following threat intelligence investigations conducted by Palo Alto Networks and Google. These investigations have identified a central figure known online as "ResoluteXBF" with connections to South African-based infrastructure. 

Even though the group was relatively new when it emerged in 2010, it has rapidly evolved from the Shai-Hulud campaign to subsequent operations that involved malware such as GlassWorm, as well as the public release of Shai-Hulud's source code, and even a high-profile GitHub breach that compromised Visual Studio Code to expose thousands of private repositories. 

The security analysts cite these incidents as evidence that attackers have shifted their approach, making developers themselves primary targets and trusted software ecosystems the preferred method of intrusion. As a result, TeamPCP's significance is greater than its volume of compromises, but it also illustrates the fragility of trust relationships that continue to underpin large portions of open-source supply chains throughout the world. 

Researchers gained a better understanding of TeamPCP's operations after digging deeper into the company's operations. Palo Alto Networks' threat intelligence assessments identified a central figure operating under the alias "ResoluteXBF," as well as associates known as "diencracked" and "Shinigami." However, numerous researchers remain of the opinion that the group is an essentially loosely connected operation with a relatively small core.

There has been speculation that a successful law enforcement action against a few individuals or possibly even one key operator  could significantly disrupt the campaign based on this structure. Even so, the group's influence has surpassed its apparent size. TeamPCP has consistently been associated with underground communities and criminal affiliates linked to BreachForums, DragonForce, ShinyHunters, Vect, Lapsus$, and HasanBroker, thereby expanding its influence and reputation through these networks. 

One notable instance occurred when the group advertised 4,000 private code repositories with a reported asking price of $95,000 on a dark web forum. Despite this, researchers contend the group is not solely concerned with financial gain. Based on the group's behavior, such as public feuds, open recruitment, reward-based challenges for supply-chain attacks, and deliberate release of offensive tooling, it is apparent that the campaign is centered on notoriety, disruption, and influence within cybercrime circles.

It is clear from TeamPCP's own metrics that there is a significant disparity: even though the group has claimed more than 10,000 victims, and earned approximately $90,000 in extortion-related earnings, its reputation and operational damage have been disproportionately greater than its revenues. 

TeamsPCP has been aggressively targeting open-source repositories and developer infrastructure in order to spread credential-stealing malware designed to harvest credentials, cloud credentials, and secrets associated with Kubernetes environments, Amazon Web Services, Microsoft Azure, Google Cloud, and other enterprise platforms. This impact is visible across the software ecosystem. Those organizations affected directly or indirectly by compromised packages include Checkmarx, Bitwarden, LiteLLM, Telnyx, Mercor AI, PyTorch Lightning, AntV, SAP, GitHub, TanStack, UiPath, Mistral AI, Microsoft DurableTask, Red Hat, and Nx Console, among others. 

Researchers have estimated that malicious packages linked to TeamPCP represent nearly 500 million weekly downloads, showing how a compromise which affects only a few repositories can spread rapidly due to interconnected dependency chains. 

The success of the group has largely been attributed to its understanding of modern development workflows rather than its malware sophistication. Through compromise of CI runners, TeamPCP effectively converted trusted software distribution channels into malware delivery channels by compromising automated systems that build, test, and publish software. 

By automatically retrieving the infected updates from a repository, downstream developers were able to retrieve them using package managers, GitHub Actions, Python libraries, NPM registries, and other software components that were configured to pull the latest releases from the repository. Using the security best practices strategy, the group aims to exploit a fundamental characteristic of software development: rapid patching and continuous updates encourage rapid trust automation, resulting in an environment where trust is routinely automated on a large scale. 

Researchers note that the group's operational tempo remains unusually aggressive. New package compromises occur almost every day, with validations, credential harvestings, and follow-on activities occurring shortly after initial access. The detection speed of defenders has increased, resulting in some malware packages being exposed within minutes, rather than several hours, as whereas TeamPCP has continued to adapt its techniques. 

A variety of toolsets have been developed by it, ranging from JavaScript and Python-based payloads to Kubernetes API attacks, bundled software development kits, and custom credential theft mechanisms. Additionally, the group's objectives have grown as they have spread the use of Mini Shai-Hulud, a self-replicating malware strain that infected hundreds of open-source packages across multiple registries, and was then publicized to encourage imitations. These developments indicate that a scale-oriented operating model has taken precedence over precision as an operating model. 

As an alternative to focusing on a select number of high-value targets, TeamPCP has adopted an approach aimed at maximizing downstream exposure, exploiting interconnected software dependencies, and generating disruption across as many environments as possible in order to maximize downstream exposure a formula that has made it one of the most consequential supply-chain threats facing the open-source community in recent years. 

The TeamPCP campaign emphasizes that the most disruptive cyber threats do not always arise from sophisticated exploits or new malware. The most common causes of these attacks are vulnerabilities in trust mechanisms that maintain the rapid pace of software development. 

By exploiting interconnected repositories, automated build systems, and dependency chains repeatedly, the threat actor has demonstrated how quickly a localized compromise can ripple across the entire digital landscape. 

Software supply chains are becoming increasingly complex, and AI-driven development is accelerating code adoption, so organizations are under increasing pressure to strengthen publisher security, validate dependencies, protect development environments, and continuously monitor build pipelines. As a consequence of TeamPCP, the resilience of the software ecosystem will be dependent not only on securing code, but on verifying every link in the delivery chain.
Read more »
Subscribe to: Posts (Atom)