Ten thousand fake GitHub repos hosting trojans
Someone found 10,000 GitHub repositories distributing malware disguised as cracked software and game cheats. The scale is wild.
Someone went hunting and found 10,000 GitHub repositories distributing trojan malware. Not ten. Not a hundred. Ten thousand. The pattern is consistent. Fake repositories claiming to offer cracked Photoshop, game cheats, or Windows activators. Each repo has a README with download instructions. The binaries steal browser cookies, crypto wallets, and Discord tokens. Most repos have zero stars, zero forks, but they rank on Google because GitHub has domain authority. The interesting bit is how automated this is. The researcher noticed the repos share naming patterns, file structures, and even commit messages. Someone built a pipeline to mass-produce these repositories faster than GitHub can take them down. The malware itself is commodity stuff, Redline and Vidar stealers mostly, but the distribution method is what scales. GitHub is a trusted domain. When you search for cracked software, a GitHub link looks more legitimate than a sketchy file host. That trust is the exploit. The attacker is not breaking into systems, they are farming clicks from people who already decided to run unsigned binaries. The researcher reported a sample set to GitHub. Some repos got taken down, others are still live. The scale makes manual takedowns pointless. You would need automated detection, but how do you write a rule that catches malicious cracks without flagging legitimate security research repositories. This is what happens when distribution is easier than detection. Ten thousand repos is not a breach, it is a business model.
Source: I found 10k GitHub repositories distributing Trojan malware