Rust-Based Info Stealers Abuse GitHub Codespaces

Summary:

Microsoft's GitHub Codespace is a feature-rich, cloud-based service that empowers developers to create software from any location using their smartphones, tablets, or any device with an internet connection and a web browser. Since its public release in November 2022, GitHub users have been able to create a minimum of two active GitHub Codespace (CS) instances for free, albeit with restrictions on storage, processing power, and duration. CS instances are independent virtual machines (VMs) hosted on Azure, accessible via web browsers, GitHub CLI, or compatible integrated developer environments (IDEs) like VSCode and JetBrains. Unfortunately, the accessibility of CS environments to all users also attracted malicious actors who quickly discovered methods to exploit the service.[emaillocker id="1283"]

Researchers recently encountered info stealers written in Rustlang that target Windows. These malwares disguise themselves as applications or platforms and exploit exposed ports on a GitHub Codespace (CS) instance to extract credentials. In a blog series, we examine one info stealer posing as a popular game, followed by analysis of its persistence on Discord post-infection. During investigation, it was observed that several intriguing function names, including anti-debugging mechanisms, as well as data theft capabilities from web browsers, Discord, Steam, cryptocurrency wallets, and various other sources. Initially, by making the use of the functions the malware checks if the sample is running in a controlled environment. The malware retrieves the username and subsequently obtains the current host name, comparing them against a collection of prohibited usernames and host names commonly associated with sandboxes and debugging environments. If a match is identified, the info stealer process is immediately terminated.

After completing the anti-debugging checks and confirming the absence of any sandbox or anti-debugging environment, the info stealer proceeds to gather sensitive credentials stored on the compromised machine. This includes passwords, cookies, and credit card details obtained from web browsers. During the analysis of the code, a notable function called "get_chromium_targets" was identified. It was found that the stealer code contains the similarities from the GitHub repository containing source code in Rust language of an Info stealer. Based on the similarities found we can say that the malware was inspired by stealer discovered in GitHub repository. The obtained credentials from each targeted web browser, cryptocurrency wallet data, Discord and Steam data, are stored within specific directories on the victim's system. The gathered files are compressed and saved as a single file in the directory path %localappdata%Microsoft. Subsequently, the info stealer uploads the compressed file to the attacker's server using a POST request, with the collected credentials from the victim included in the body of the request. Finally, the stolen information is submitted to the GitHub webhook, which is under the control of the attacker.

Threat Profile:

References:

The following reports contain further technical details:

https://www.trendmicro.com/en_us/research/23/e/rust-based-info-stealers-abuse-github-codespaces.html