EXECUTIVE SUMMARY:
A malware campaign known as Water Curse has been uncovered, which leverages GitHub as a delivery vector for malicious payloads. The threat actors behind this campaign created numerous fake or cloned GitHub accounts to publish seemingly legitimate open-source tools such as email bombers and remote access trojans. These repositories are designed to appeal to developers, cybersecurity professionals, red teamers, gamers, and other technically inclined individuals who often rely on community-shared utilities. However, the repositories are laced with hidden malware embedded in project files, build scripts, and configuration settings. Once a victim downloads and opens one of these projects in an integrated development environment like Visual Studio, the malware is triggered automatically through build events.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
A malware campaign known as Water Curse has been uncovered, which leverages GitHub as a delivery vector for malicious payloads. The threat actors behind this campaign created numerous fake or cloned GitHub accounts to publish seemingly legitimate open-source tools such as email bombers and remote access trojans. These repositories are designed to appeal to developers, cybersecurity professionals, red teamers, gamers, and other technically inclined individuals who often rely on community-shared utilities. However, the repositories are laced with hidden malware embedded in project files, build scripts, and configuration settings. Once a victim downloads and opens one of these projects in an integrated development environment like Visual Studio, the malware is triggered automatically through build events.[emaillocker id="1283"]
The infection begins with the misuse of build automation features such as PreBuildEvent in Visual Studio project files, which silently launch obfuscated scripts. These scripts often use VBS and PowerShell to fetch encrypted payloads from remote servers. The malware payloads are typically Electron-based binaries that execute various functions depending on the stage of the infection. They implement anti-debugging techniques, gain elevated privileges, establish persistence through registry edits and scheduled tasks, and harvest sensitive data such as browser credentials, tokens, system metadata, and application sessions. Data exfiltration is done via messaging APIs and cloud storage platforms. The threat actor’s malware arsenal includes customized stealers, fake security tools, browser session hijackers, and crypto-related malware. These tools are not only distributed via fake repositories but are also disguised as cheating tools for online games or penetration testing software.
Water Curse highlights the growing danger of software supply chain attacks that target developers and IT professionals through trusted platforms. By embedding malware in build scripts and open-source project files, the actors exploit the inherent trust in shared developer resources. This attack method bypasses traditional detection tools and relies on the victim’s actions to trigger the malicious payloads during regular development workflows. To mitigate such threats, developers should adopt best practices such as using internal repositories, reviewing build scripts for unexpected commands, and isolating environments used for testing unverified code. Additionally, organizations should implement endpoint detection solutions capable of identifying unusual scripting behavior and communication with known command-and-control channels. Awareness and proactive monitoring are critical, especially in environments that rely heavily on third-party or community-contributed code.
THREAT PROFILE:
| Tactic | Technique ID | Technique | Sub-technique |
| Resource Development | T1583/001 | Acquire Infrastructure | Domains |
| T1583/006 | Acquire Infrastructure | Web Services | |
| Initial Access | T1195/002 | Supply Chain Compromise | Compromise Software Supply Chain |
| Execution | T1059/001 | Command and Scripting Interpreter | PowerShell |
| T1059/005 | Command and Scripting Interpreter | Visual Basic | |
| T1203 | Exploitation for Client Execution | — | |
| Persistence | T1547/001 | Boot or Logon Autostart Execution | Registry Run Keys / Startup Folder |
| Privilege Escalation | T1548/002 | Abuse Elevation Control Mechanism | Bypass User Access Control |
| Defense Evasion | T1027 | Obfuscated Files or Information | — |
| T1562/001 | Impair Defenses | Disable or Modify Tools | |
| Credential Access | T1555/003 | Credentials from Password Stores | Credentials from Web Browsers |
| Discovery | T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — | |
| T1518/001 | Software Discovery | Security Software Discovery | |
| Collection | T1119 | Automated Collection | — |
| Command and control | T1102/002 | Web Service | Bidirectional Communication (e/g/, Telegram) |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | — |
| Impact | T1490 | Inhibit System Recovery | — |
MBC MAPPING:
| Objective | Behavior ID | Behavior |
| Command and control | B0030 | C2 Communication |
| Defense Evasion | E1055 | Process Hollowing |
| F0007 | Self-Deletion | |
| Anti-Behavioral Analysis | B0001 | Debugger Detection |
| B0009 | Virtual Machine Detection | |
| Execution | B0011 | Remote Commands |
| Persistence | F0012 | Registry Run Keys / Startup Folder |
| Cryptography Micro-objective | C0027 | Encrypt Data |
| Discovery | B0013 | Analysis Tool Discovery |
REFERENCES:
The following reports contain further technical details:
[/emaillocker]