GitHub, Telegram Bots, and QR Codes Abused in New Wave of Phishing Assaults

A brand new tax-themed malware marketing campaign focusing on insurance coverage and finance sectors has been noticed leveraging GitHub hyperlinks in phishing e-mail messages as a technique to bypass safety measures and ship Remcos RAT, indicating that the strategy is gaining traction amongst menace actors.

“On this marketing campaign, official repositories such because the open-source tax submitting software program, UsTaxes, HMRC, and InlandRevenue have been used as an alternative of unknown, low-star repositories,” Cofense researcher Jacob Malimban said.

“Utilizing trusted repositories to ship malware is comparatively new in comparison with menace actors creating their very own malicious GitHub repositories. These malicious GitHub hyperlinks could be related to any repository that permits feedback.”

Central to the assault chain is the abuse of GitHub infrastructure for staging the malicious payloads. One variation of the method, first disclosed by OALABS Analysis in March 2024, entails menace actors opening a GitHub problem on well-known repositories and importing to it a malicious payload, after which closing the problem with out saving it.

In doing so, it has been discovered that the uploaded malware persists although the problem is rarely saved, a vector that has change into ripe for abuse because it permits attackers to add any file of their alternative and never depart any hint aside from the hyperlink to the file itself.

The method has been weaponized to trick customers into downloading a Lua-based malware loader that’s able to establishing persistence on contaminated programs and delivering further payloads, as detailed by Morphisec this week.

The phishing marketing campaign detected by Cofense employs the same tactic, the one distinction being that it makes use of GitHub comments to connect a file (i.e., the malware), after which the remark is deleted. Like within the aforementioned case, the hyperlink stays lively and is propagated by way of phishing emails.

“Emails with hyperlinks to GitHub are efficient at bypassing SEG safety as a result of GitHub is usually a trusted area,” Malimban stated. “GitHub hyperlinks enable menace actors to instantly hyperlink to the malware archive within the e-mail with out having to make use of Google redirects, QR codes, or different SEG bypass strategies.”

The event comes as Barracuda Networks revealed novel strategies adopted by phishers, together with ASCII- and Unicode-based QR codes and blob URLs as a technique to make it tougher to dam malicious content material and evade detection.

“A blob URI (also called a blob URL or an object URL) is utilized by browsers to symbolize binary information or file-like objects (known as blobs) which can be briefly held within the browser’s reminiscence,” safety researcher Ashitosh Deshnur said.

“Blob URIs enable internet builders to work with binary information like pictures, movies, or information instantly throughout the browser, with out having to ship or retrieve it from an exterior server.”

It additionally follows new analysis from ESET that the menace actors behind the Telekopye Telegram toolkit have expanded their focus past on-line market scams to focus on lodging reserving platforms similar to Reserving.com and Airbnb, with a pointy uptick detected in July 2024.

The assaults are characterised by way of compromised accounts of official motels and lodging suppliers to contact potential targets, claiming purported points with the reserving cost and tricking them into clicking on a bogus hyperlink that prompts them to enter their monetary data.

“Utilizing their entry to those accounts, scammers single out customers who not too long ago booked a keep and have not paid but – or paid very not too long ago – and get in touch with them by way of in-platform chat,” researchers Jakub Souček and Radek Jizba said. “Relying on the platform and the Mammoth’s settings, this results in the Mammoth receiving an e-mail or SMS from the reserving platform.”

“This makes the rip-off a lot tougher to identify, as the knowledge supplied is personally related to the victims, arrives by way of the anticipated communication channel, and the linked, pretend web sites look as anticipated.”

What’s extra, the diversification of the victimology footprint has been complemented by enhancements to the toolkit that enable the scammer teams to hurry up the rip-off course of utilizing automated phishing web page era, enhance communication with targets by way of interactive chatbots, defending phishing web sites towards disruption by opponents, and different objectives.

Telekopye’s operations haven’t been with out their fair proportion of hiccups. In December 2023, legislation enforcement officers from Czechia and Ukraine introduced the arrest of a number of cybercriminals who’re alleged to have used the malicious Telegram bot.

“Programmers created, up to date, maintained and improved the functioning of Telegram bots and phishing instruments, in addition to making certain the anonymity of accomplices on the web and offering recommendation on concealing prison exercise,” the Police of the Czech Republic said in an announcement on the time.

“The teams in query have been managed, from devoted workspaces, by middle-aged males from Japanese Europe and West and Central Asia,” ESET stated. “They recruited folks in tough life conditions, by way of job portal postings promising ‘straightforward cash,’ in addition to by focusing on technically expert overseas college students at universities.”