Report of a malicious repository

[shahkashyap]

Select Topic Area

Show & Tell

Body

I am writing to report a repository that contains a trojan virus. The repository is called ### BLXStealer and it claims to be a password stealer from Google Account. However, when I downloaded and Extract it , it infected my computer with a trojan virus that stole my personal information and files.
I request you to take immediate action to remove this repository and warn other users about the potential danger. This repository violates your terms of service and poses a serious threat to the security and privacy of your users.

Here is the git repository Link : https://github.com/blxstealer/BLX-Stealer

[ldez]

Hello,

if you have a problem with a GitHub account contact the GitHub support.

Note: the archive is built by GitHub, so you ran this tool to be infected.
A hidden Remote access trojan (RAT) was inside the code.

I reported the account to GitHub support with all the information but you have to do the same:

• Go to the user profile: https://github.com/blxstealer.
• Click on "Block or Report" at the bottom left of the page.
• And choose "Report Abuse" and follow the process.

You have learned a lesson: never run this kind of project on your computer, and always read the code before running it.

[overtube]

This repo: https://github.com/openhardwaremonitor/openhardwaremonitor when installing on system, using system package manager (that have chroot), after ending installation, post install executing hook that that placing on /usr/share directory, 144 ssh root certificates. Offcource code safe and program worked well, but post install activity make malicious, thing because not ask user for trust or not and just wilfully install root certificates.

[tayl054]

We have discovered that a malicious bad actor has setup a fake repo and a fake MAC-OS binary file to fake out users and put a malware on their computer.

Our Github Ticket ID: 2723902

The malcious actor setup the account at https://github.com/macos-support
under repos called Sonymusic and Sony with SME.dmg setup as the fake payload.

If you have any questions about this attack please reach out to me using my Github profile

[hideandseekstheorder]

Select Topic Area

Show & Tell

Body
I am writing to report a repository that contains a trojan virus. The repository is called ### BLXStealer and it claims to be a password stealer from Google Account. However, when I downloaded and Extract it , it infected my computer with a trojan virus that stole my personal information and files.
I request you to take immediate action to remove this repository and warn other users about the potential danger. This repository violates your terms of service and poses a serious threat to the security and privacy of your users.

Here is the git repository Link : https://github.com/SysAdminAce83/CCleaner-Professional

[hideandseekstheorder]

https://www.virustotal.com/gui/file/0ecddd9233d9f22116e0531b111496d0a7d9cbaf51583f5a0a26711f0078ebdf/detection

[bemax11]

I am writing to report a repository that contains a trojan virus, Hosting cpanel attack. cURL Link: https://github.com/ghostuserx/culrtest/main/index-mainfile.txt

[ldez]

Hello,

If you have a problem with a GitHub account or a repository, contact GitHub support.

• Go to the user profile
• Click "Block or Report" at the bottom left of the page.
• Choose "Report Abuse" and follow the process.

https://docs.github.com/en/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam

[Heroharley]

https://github.com/SuppliedOrange/VALORANT-Instalocker is malware checked with virus total

[ldez]

Hello,

If you have a problem with a GitHub account or a repository, contact GitHub support.

• Go to the user profile
• Click "Block or Report" at the bottom left of the page.
• Choose "Report Abuse" and follow the process.

https://docs.github.com/en/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam