Cybersecurity researchers have uncovered a beforehand unknown menace actor generally known as Water Curse that depends on weaponized GitHub repositories to ship multi-stage malware.
“The malware permits information exfiltration (together with credentials, browser information, and session tokens), distant entry, and long-term persistence on contaminated methods,” Pattern Micro researchers Jovit Samaniego, Aira Marcelo, Mohamed Fahmy, and Gabriel Nicoleta mentioned in an evaluation printed this week.
The “broad and sustained” marketing campaign, first noticed final month, arrange repositories providing seemingly innocuous penetration testing utilities, however harbored inside their Visible Studio mission configuration information malicious payloads akin to SMTP e mail bomber and Sakura-RAT.
Water Curse’s arsenal incorporates a variety of instruments and programming languages, underscoring their cross-functional improvement capabilities to focus on the provision chain with “developer-oriented data stealers that blur the road between crimson crew tooling and lively malware distribution.”
“Upon execution, the malicious payloads initiated advanced multistage an infection chains using obfuscated scripts written in Visible Primary Script (VBS) and PowerShell,” the researchers mentioned. “These scripts downloaded encrypted archives, extracted Electron-based functions, and carried out in depth system reconnaissance.”
The assaults are additionally characterised by way of anti-debugging methods, privilege escalation strategies, and persistence mechanisms to keep up a long-term foothold on the affected hosts. Additionally employed are PowerShell scripts to weaken host defenses and inhibit system restoration.
Water Curse has been described as a financially motivated menace actor that is pushed by credential theft, session hijacking, and resale of illicit entry. As many as 76 GitHub accounts have been linked to the marketing campaign. There may be proof to counsel associated exercise could have been ongoing all the way in which again to March 2023.
The emergence of Water Curse is the most recent instance of how menace actors are abusing the belief related to reliable platforms like GitHub as a supply channel for malware and stage software program provide chain assaults.
“Their repositories embody malware, evasion utilities, sport cheats, aimbots, cryptocurrency pockets instruments, OSINT scrapers, spamming bots, and credential stealers,” Pattern Micro mentioned. “This displays a multi-vertical concentrating on technique that blends cybercrime with opportunistic monetization.”
“Their infrastructure and conduct point out a concentrate on stealth, automation, and scalability, with lively exfiltration through Telegram and public file-sharing companies.”
The disclosure comes as a number of campaigns have been noticed leveraging the prevalent ClickFix technique to deploy varied malware households akin to AsyncRAT, DeerStealer (through a loader named Hijack Loader), Filch Stealer, LightPerlGirl, and SectopRAT (additionally through Hijack Loader).
AsyncRAT is likely one of the many available distant entry trojans (RATs) that has been put to make use of by unidentified menace actors to indiscriminately goal hundreds of organizations spanning a number of sectors since early 2024. Some facets of the marketing campaign have been documented by Forcepoint in August 2024 and January 2025.
“This tradecraft permits the malware to bypass conventional perimeter defenses, notably by utilizing Cloudflare’s short-term tunnels to serve payloads from seemingly reliable infrastructure,” Halcyon mentioned. “These tunnels present attackers with ephemeral and unregistered subdomains that seem reliable to perimeter controls, making it troublesome to pre-block or blacklist.”
“As a result of the infrastructure is spun up dynamically through reliable companies, defenders face challenges in distinguishing malicious use from licensed DevOps or IT upkeep workflows. This tactic permits menace actors to ship payloads with out counting on compromised servers or bulletproof internet hosting, rising each the dimensions and stealth of the marketing campaign.”
The findings additionally comply with the discovery of an ongoing malicious marketing campaign that has focused varied European organizations positioned in Spain, Portugal, Italy, France, Belgium, and the Netherlands with invoice-themed phishing lures to ship a named Sorillus RAT (aka Ratty RAT).
Earlier campaigns distributing the malware have singled out accounting and tax professionals utilizing revenue tax return decoys, a few of which have leveraged HTML smuggling methods to hide the malicious payloads.
The assault chain detailed by Orange Cyberdefense employs comparable phishing emails that purpose to trick recipients into opening PDF attachments containing a OneDrive hyperlink that factors to a PDF file instantly hosted on the cloud storage service whereas prompting the consumer to click on an “Open the doc” button.
Doing so redirects the sufferer to a malicious net server that acts as a visitors distribution system (TDS) to guage the incoming request and decide whether or not they should proceed additional to the following stage of the an infection. If the sufferer’s machine meets the mandatory standards, they’re displayed a benign PDF whereas a JAR file is stealthily downloaded to drop and execute Sorillus RAT.
A Java-based RAT that first surfaced in 2019, Sorillus is a cross-platform malware that may harvest delicate data, obtain/add information, take screenshots, file audio, log keystrokes, run arbitrary instructions, and even uninstall itself. It additionally does not assist that quite a few racked variations of the trojan can be found on-line.
The assaults are assessed to be a part of a broader marketing campaign that has been noticed delivering SambaSpy to customers in Italy. SambaSpy, per Orange Cyberdefense, belongs to the Sorillus malware household.
“The operation showcases a strategic mix of reliable companies – akin to OneDrive, MediaFire, and tunneling platforms like Ngrok and LocaltoNet – to evade detection,” the cybersecurity firm mentioned. “The repeated use of Brazilian Portuguese in payloads helps a probable attribution to Brazilian-speaking menace actors.”
