Cybersecurity researchers have discovered a sophisticated campaign where attackers created over 67 fake GitHub repositories disguising malware as legitimate Python hacking tools. This operation, dubbed “Banana Squad” by ReversingLabs, represents an evolution of malicious activities targeting developers and users seeking software tools.
## The Banana Squad Campaign
The campaign builds upon a 2023 attack that targeted Python Package Index (PyPI) with fraudulent packages downloaded over 75,000 times. These packages contained information-stealing capabilities specifically designed for Windows systems.
The operation gained attention after SANS Internet Storm Center identified a fake “steam-account-checker” tool in November 2024. This malicious software secretly downloaded additional Python payloads capable of:
– Injecting malicious code into Exodus cryptocurrency wallets
– Harvesting sensitive user data
– Transmitting stolen information to external servers
Researchers discovered that attackers created 67 trojanized repositories impersonating legitimate tools, targeting users searching for:
– Discord account cleaners
– Fortnite game cheats
– TikTok username checkers
– PayPal bulk account checkers
GitHub has since removed all identified malicious repositories.
## Growing Threat to Software Supply Chain
“Backdoors and trojanized code in publicly available source code repositories like GitHub are becoming more prevalent and represent a growing software supply chain attack vector,” explained ReversingLabs researcher Robert Simmons. He emphasized the importance of developers verifying repository contents before use.
## Multiple Attack Campaigns Emerge
Security researchers have identified several concurrent campaigns exploiting GitHub:
**Water Curse Operation**: Trend Micro discovered 76 malicious repositories distributing multi-stage malware designed to steal credentials, browser data, and session tokens while maintaining persistent system access.
**Stargazers Ghost Network**: Check Point revealed a criminal service targeting Minecraft users with Java-based malware. This network uses multiple fake GitHub accounts that star, fork, and subscribe to malicious repositories to appear legitimate and boost search rankings.
**Backdoored Tool Repositories**: Sophos identified 133 compromised repositories targeting novice cybercriminals seeking attack tools. These repositories contained four types of backdoors embedded in Visual Studio PreBuild events, Python scripts, screensaver files, and JavaScript.
## Distribution Methods and Impact
The malicious repositories often masquerade as popular gaming tools, cryptocurrency trackers, and betting prediction software. Attackers use fake stars and frequent updates to artificially inflate repository popularity and improve search visibility.
Evidence suggests threat actors distribute links through Discord servers and YouTube channels, operating as part of a Distribution-as-a-Service (DaaS) model active since August 2022.
## Future Implications
Security experts warn that these GitHub-based attacks represent a growing trend in software supply chain compromises. While current campaigns primarily target gamers and inexperienced cybercriminals, researchers anticipate attackers may expand to target broader user groups as the technique proves effective.
The incidents highlight the critical need for enhanced verification processes when downloading software from open-source repositories, as GitHub increasingly becomes a preferred platform for malware distribution.