add github piece

Author: AdamXweb

content/blog/github-exploited.md

@@ -0,0 +1,74 @@
+---
+title: 'Githubs reputation being exploited by bad actors to distribute malware'
+date: 2025-09-22T18:42:13.000+10:00
+slug: github-macos-malware
+description: Bad actors are abusing the SEO of github
+image: "/uploads/"
+keywords:
+- github organisation malware
+- github readme exploit
+- macos app malware distribution
+- adam kostarelas
+- blog
+author: Adam Kostarelas
+tags:
+- tech
+math: false
+toc: false
+
+---
+
+Github has become popular over the years for a place where you can collaborate on open-source software, and download it too.
+This reputation can be abused to by bad actors, pretending that software is open source, when in reality they link to a compiled file, or to an external site.
+
+Today I spotted one such that came up high in search results for `macos audio`
+There were two separate results that came up, im
+
+If you search directly for `macos sound source` or `macos sound control`, they rank highly.
+
+![High search rank on Kagi](/uploads/gh-mac/highsearchrank.png) 
+
+Obviously, you'd want to always make sure you're going to an official website to download software, however with namesquatting, seo farming and reputation abusing techniques, such bad actors have higher chances of malicious actions.
+
+A common trend is to encourage users to open terminal to download a shell script. 
+! warning, never paste random commands into your terminal without knowing what it does!
+
+![Fake website imitating github](/uploads/gh-mac/fakegithub.png) 
+
+In this case, the url is also a URL encoded with base64 to make it less obvious you're about to download `install.sh`
+
+the shell script tries to download a malicious file called *update*, then deletes all extended attributes macos places on it with `xattr -c update` and makes it executable.
+
+luckily gatekeeper tried to prevent me even inspecting this file in a VM
+![MacOS Gatekeeper warning prompt](/uploads/gh-mac/dontopen.png) 
+
+If you're interested, the [virustotal](https://www.virustotal.com/gui/file/8bd91ce62189cc6817aff0577a4cad0d5884b806f07443b2296718a64402c82d/behavior) analysis is available to review.
+
+It contains an interesting evasion tactic I haven't seen before
+
+![evasion tactic to detect if is in a vm](/uploads/gh-mac/vmevasion.png)
+
+The page users click on to download the file are also prompted to download a dmg which is just obfuscated to run another osascript to remove quarantine and run the `stackprep`
+
+![stack prep](/uploads/gh-mac/stackprep.png)
+
+
+## Github tactic
+
+I'm not sure as to why this was done, but there were multiple accounts spawned to maybe aid in their evasion efforts?
+One organisation will point to a user account, which doesn't commit anything, but another user account will upload files via browser.
+
+All the accounts are using throwaway hotmail and outlook accounts.
+
+I've reported this to Github, who is aware of attacks like this, and have taken down a similarly named one which is still ranking highly in search.
+
+I wonder if their section on SEO actually helps them to rank..
+
+![Github readme profile with seo keywords](/uploads/gh-mac/seokeywords.png) 
+
+Also another tidbit, their 'demo video' shows a Parallels VM with user `checkuser`. Maybe there's some kind of quality control to make sure users in a VM aren't impacted. (sarcasm)
+![screenshot from their install video](/uploads/gh-mac/itsavm.png) 
+
+I hope these are removed to keep Github a safe community.
+
+You can contact me if you'd like more info