A sophisticated malware campaign has emerged exploiting the trusted GitHub platform to distribute malicious software disguised as legitimate tools.

Threat actors have successfully weaponized the popular code repository to host and distribute the notorious Lumma Stealer malware, masquerading it as helpful utilities like “Free VPN for PC” and “Minecraft Skin Changer.”

This deceptive campaign demonstrates how cybercriminals are increasingly leveraging reputable platforms to bypass security measures and exploit user trust.

The malware operation centers around a dropper named Launch.exe, which serves as the initial payload delivery mechanism.

When unsuspecting users download what they believe to be free software from the GitHub repository hosted by user SAMAIOEC, they inadvertently execute a sophisticated multi-stage malware deployment system.

The campaign’s success lies in its social engineering approach, targeting users seeking free alternatives to paid software solutions.

Cyfirma analysts identified this threat through comprehensive monitoring of emerging cyber campaigns targeting both organizations and individuals.

The research revealed that the malware employs advanced evasion techniques, including process injection, DLL side-loading, and complex obfuscation methods to avoid detection by traditional security solutions.

The campaign’s infrastructure includes multiple command and control servers, with the primary domain explorationmsn.store serving as the communication hub for the malware’s operations.

The technical analysis reveals that Launch.exe functions as a sophisticated dropper containing Base64-encoded malicious payloads.

Fake Assembly Metadata (Source – Cyfirma)

Upon execution, the malware performs several deceptive operations, beginning with the creation of fake assembly metadata designed to confuse automated analysis tools.

The assembly information includes nonsensical entries such as “CompanyName” listed as “run he think” and “FileDescription” as “collaborate black system,” indicating the use of automated malware builders to generate random metadata.

Infection Mechanism and Payload Deployment

The malware’s infection mechanism demonstrates advanced technical sophistication through its multi-stage payload delivery system.

The initial Launch.exe dropper contains a Base64-encoded DLL that undergoes complex decoding and obfuscation processes before execution.

Obfuscation Technique (Source – Cyfirma)

The malware employs a custom function called SinCosMath() that performs bitwise operations on the encoded payload, applying bitwise NOT operations followed by arithmetic subtractions to decrypt the hidden malicious code.

private static void SinCosMath(byte[] data)
{
    for (int i = 0; i < data. Length; i++)
    {
        data[i] = ~data[i];
        int num = i;
        data[num] -= 121;
        int num2 = i;
        data[num2] -= 87;
    }
}

Once decoded, the malware drops a file named msvcp110.dll into the user’s AppData\Roaming directory and immediately applies hidden file attributes to conceal its presence.

The dropper then utilizes dynamic loading techniques through Windows API calls including LoadLibrary and GetProcAddress to execute the malicious DLL’s GetGameData export function.

This approach enables the malware to inject its payload into legitimate Windows processes such as MSBuild.exe and aspnet_regiis.exe, effectively hiding its malicious activities within trusted system processes while establishing persistence and evading detection mechanisms.

Investigate live malware behavior, trace every step of an attack, and make faster, smarter security decisions -> Try ANY.RUN now

The post Hackers Abused GitHub to Spread Malware Mimic as VPN appeared first on Cyber Security News.