GitHub Removes 10,000 Malware Repositories After Public Exposure but Takes No Further Action
Thousands of repositories on GitHub are actively distributing trojans through ZIP archives, and any user can locate them using the platform's built-in search without specialized tools. These repositories have remained online for at least two years even though GitHub possesses substantial financial resources, a dedicated security team, and access to artificial intelligence systems.
The malicious repositories share clear structural patterns. Each contains a README file with headings such as "## 📥 Download", "## 📥 Download Now", or "## 📥 Download the Software", followed by a direct link to a ZIP archive hosted on githubusercontent.com or github.com. The archives contain executable files that multiple antivirus engines on VirusTotal flag as malicious.
Researchers refined search queries to surface additional instances. Starting with path:readme.md "## 📥 Download" and adding terms such as ".zip" produced more targeted results. Further refinement using regular expressions for versioned archive links, such as /raw\.githubusercontent\.com\/.*\d+\.\d+\.zip/, isolated repositories that match the malware distribution pattern.
One month earlier, a detailed article describing the scheme and a script that located 10,000 matching repositories were published on Hacker News. The post received significant attention from other security outlets. In response, GitHub deleted the 10,000 repositories identified by the script. No additional repositories matching the same patterns have been removed since, even though new ones continue to appear and the original article remains publicly available.
The limited response raises questions about internal processes at Microsoft, which owns GitHub. Despite having thousands of employees and tools such as Copilot, the company has not deployed sustained detection efforts against this ongoing malware campaign.
Related articles
Malinsure Cybercrime Group Deploys SafeMostSSH Backdoor via Phishing Lures Mimicking Russian Insurance Updates
Researchers from F6 identified a previously unknown cybercrime cluster named Malinsure that has been active since at least July 2026. The group distributes phishing emails containing PDF lures themed around voluntary medical insurance (DMS) discounts and updates from Russian insurance companies. Victims are tricked into downloading RAR or ZIP archives that abuse legitimate Microsoft binaries such as winword.exe and powerpnt.exe through DLL side-loading to execute the custom SafeMostSSH backdoor. The malware establishes a persistent reverse SSH tunnel to attacker-controlled servers and retrieves fresh C2 addresses from public posts on vc.ru by decoding fake PNG links. Additional delivery vectors include HTML and SHTML files that decode and drop archives containing the same payload components. Targets appear to include insurance, finance, and fuel-energy sector organizations, with infrastructure also referencing gosuslugi.email and minfin.support domains.
Compromised Chromium Extensions Push Malware Through Fake Critical Update Alerts
Users of Chromium-based browsers including Chrome, Brave, and Opera have encountered persistent pop-up windows demanding immediate browser updates. These alerts originate from compromised extensions that dynamically load malicious VBS scripts or EXE files instead of delivering legitimate updates. The deceptive messages appear during normal browsing and instruct users to download and manually execute suspicious files. Earlier incidents were traced to the QuickLens extension, while current reports implicate Enable Right Click & Copy Smart Unlock + OCR and similar utilities still available in the Chrome Web Store. Attackers achieve persistence by purchasing popular extensions or hijacking developer accounts to push malicious updates. Full system scans often fail to detect the threat because the browser itself remains clean until the user triggers the payload. Security experts recommend verifying updates exclusively through the browser's built-in menu rather than clicking any on-screen prompts.
Palo Alto Networks Unit 42 Uncovers Kimwolf v7 Botnet Infecting Android Set-Top Boxes via Open ADB
Researchers at Palo Alto Networks Unit 42 have identified Kimwolf v7, an updated botnet that compromises Android set-top boxes and other IoT devices to conduct DDoS attacks. The malware now employs HTTP/2 flooding with realistic browser fingerprints to blend malicious traffic with legitimate user activity. Command-and-control infrastructure is hardened through Ethereum Name Service lookups and public Ethereum RPC services, with a Tor fallback address embedded in the binary. Operators have removed scanning, exploitation, and brute-force capabilities from this version, indicating a division of labor where a separate loader handles initial infection. The botnet uses 15 numbered methods focused on high-performance UDP floods optimized for ARM processors. Infections typically occur through residential proxies targeting devices with open Android Debug Bridge on port 5555, after which the malware masquerades as system processes. Unit 42 advises treating Android set-top boxes as untrusted devices and disabling ADB or restricting it to USB access only.
Google Play Apps Hide Anatsa Banking Trojan Using Stealthy Loaders
Malicious applications distributed through Google Play are employing stealthy loaders to install the Anatsa banking trojan for Android, putting victims' financial accounts at risk. The campaign relies on seemingly legitimate programs to conceal the initial infection stage, with one identified case involving a modified PDF reader that displays a fake update prompt to trick users into installing an additional component. Another loader discovered in the Cleanova application collects data from analytics SDKs, including installation source details, and forwards this information to a command-and-control server. The server then decides whether to deliver the malicious payload based on predefined criteria, leaving the code inactive for non-targeted victims to evade automated analysis. Once Anatsa is installed, the threat can facilitate theft of credentials used for financial services and enable fraudulent transactions. Banking trojans represented 30.77 percent of detected malicious mobile applications in the second quarter of 2026, during which more than 1.99 million attacks involving malware, adware, or unwanted programs were blocked and 93,574 banking trojan installation packages were identified.