Malware activity seems to be increasing.
There's on other very insidious technique I found. I think it's rare but it's worth noting. It requires a compromised,
but otherwise legitimate github account.
If the account has weak security settings a malfaisant can create a github account of his own and use it to hack
the poorly secured legitimate account to make changes. In the instance I saw the previously unused wiki was the
target of the attack. The legimate owner may not even notice if notifications aren't turned on or are not checked.
The wiki was updated to do one thing: redirect to the malware hosted elsewhere. Then a link was posted in the mining
board and it looks like it points to a legitimate github account, which it is, before redirecting to the malware.
The fake github account was not used to host the malware, it was only used as a side door into a legitimate github
account. The malware was hosted elsewhere.
This redirection could go on for some time without the user realizing he's being used. When I alerted the user in this case
he was unaware but took switft action.
As long as github users have proper security and don't allow just any user to make changes to their repo this can't
happen. But it did because it didn't.*
For those not fluent in englsih or are just not good with riddles my apologies, here's the long version:
But it [ the hack] did [happen] because it [the repo] didn't [have proper security].
