Cybersecurity researchers have uncovered a beforehand unknown menace actor referred to as Water Curse that depends on weaponized GitHub repositories to ship multi-stage malware.
“The malware permits knowledge exfiltration (together with credentials, browser knowledge, and session tokens), distant entry, and long-term persistence on contaminated techniques,” Pattern Micro researchers Jovit Samaniego, Aira Marcelo, Mohamed Fahmy, and Gabriel Nicoleta stated in an evaluation printed this week.
The “broad and sustained” marketing campaign, first noticed final month, arrange repositories providing seemingly innocuous penetration testing utilities, however harbored inside their Visible Studio venture configuration recordsdata malicious payloads comparable to SMTP e-mail bomber and Sakura-RAT.
Water Curse’s arsenal incorporates a variety of instruments and programming languages, underscoring their cross-functional improvement capabilities to focus on the provision chain with “developer-oriented info stealers that blur the road between pink workforce tooling and lively malware distribution.”
“Upon execution, the malicious payloads initiated complicated multistage an infection chains using obfuscated scripts written in Visible Fundamental Script (VBS) and PowerShell,” the researchers stated. “These scripts downloaded encrypted archives, extracted Electron-based purposes, and carried out intensive system reconnaissance.”
The assaults are additionally characterised by means of anti-debugging strategies, privilege escalation strategies, and persistence mechanisms to take care of a long-term foothold on the affected hosts. Additionally employed are PowerShell scripts to weaken host defenses and inhibit system restoration.
Water Curse has been described as a financially motivated menace actor that is pushed by credential theft, session hijacking, and resale of illicit entry. As many as 76 GitHub accounts have been linked to the marketing campaign. There may be proof to recommend associated exercise might have been ongoing all the way in which again to March 2023.
The emergence of Water Curse is the most recent instance of how menace actors are abusing the belief related to reliable platforms like GitHub as a supply channel for malware and stage software program provide chain assaults.
“Their repositories embrace malware, evasion utilities, recreation cheats, aimbots, cryptocurrency pockets instruments, OSINT scrapers, spamming bots, and credential stealers,” Pattern Micro stated. “This displays a multi-vertical focusing on technique that blends cybercrime with opportunistic monetization.”
“Their infrastructure and habits point out a concentrate on stealth, automation, and scalability, with lively exfiltration by way of Telegram and public file-sharing companies.”
The disclosure comes as a number of campaigns have been noticed leveraging the prevalent ClickFix technique to deploy numerous malware households comparable to AsyncRAT, DeerStealer (by way of a loader named Hijack Loader), Filch Stealer, LightPerlGirl, and SectopRAT (additionally by way of Hijack Loader).
AsyncRAT is likely one of the many available distant entry trojans (RATs) that has been put to make use of by unidentified menace actors to indiscriminately goal hundreds of organizations spanning a number of sectors since early 2024. Some features of the marketing campaign had been documented by Forcepoint in August 2024 and January 2025.
“This tradecraft permits the malware to bypass conventional perimeter defenses, notably by utilizing Cloudflare’s momentary tunnels to serve payloads from seemingly reliable infrastructure,” Halcyon stated. “These tunnels present attackers with ephemeral and unregistered subdomains that seem reliable to perimeter controls, making it troublesome to pre-block or blacklist.”
“As a result of the infrastructure is spun up dynamically by way of reliable companies, defenders face challenges in distinguishing malicious use from licensed DevOps or IT upkeep workflows. This tactic permits menace actors to ship payloads with out counting on compromised servers or bulletproof internet hosting, growing each the size and stealth of the marketing campaign.”
The findings additionally comply with the invention of an ongoing malicious marketing campaign that has focused numerous European organizations situated in Spain, Portugal, Italy, France, Belgium, and the Netherlands with invoice-themed phishing lures to ship a named Sorillus RAT (aka Ratty RAT).
Earlier campaigns distributing the malware have singled out accounting and tax professionals utilizing earnings tax return decoys, a few of which have leveraged HTML smuggling strategies to hide the malicious payloads.
The assault chain detailed by Orange Cyberdefense employs related phishing emails that purpose to trick recipients into opening PDF attachments containing a OneDrive hyperlink that factors to a PDF file immediately hosted on the cloud storage service whereas prompting the person to click on an “Open the doc” button.
Doing so redirects the sufferer to a malicious net server that acts as a visitors distribution system (TDS) to judge the incoming request and decide whether or not they should proceed additional to the subsequent stage of the an infection. If the sufferer’s machine meets the mandatory standards, they’re displayed a benign PDF whereas a JAR file is stealthily downloaded to drop and execute Sorillus RAT.
A Java-based RAT that first surfaced in 2019, Sorillus is a cross-platform malware that may harvest delicate info, obtain/add recordsdata, take screenshots, file audio, log keystrokes, run arbitrary instructions, and even uninstall itself. It additionally does not assist that quite a few racked variations of the trojan can be found on-line.
The assaults are assessed to be a part of a broader marketing campaign that has been noticed delivering SambaSpy to customers in Italy. SambaSpy, per Orange Cyberdefense, belongs to the Sorillus malware household.
“The operation showcases a strategic mix of reliable companies – comparable to OneDrive, MediaFire, and tunneling platforms like Ngrok and LocaltoNet – to evade detection,” the cybersecurity firm stated. “The repeated use of Brazilian Portuguese in payloads helps a probable attribution to Brazilian-speaking menace actors.”
Discovered this text fascinating? Comply with us on Twitter and LinkedIn to learn extra unique content material we publish.
