GitHub Supply Chain Attack: StealC 2.0 Evasion via Binary Padding & Blockchain Smart Contracts

The Heist: An Analogy for Modern Info-Stealers

Act I

The Trojan Gift

Meet Alex, an IT engineer. Browsing the workshop (GitHub), he spots a highly rated "Advanced Security Dashboard." Thrilled, he downloads the free tool. Without knowing it, Alex just wheeled a modern Trojan Horse through his front door.

Act II

The Silent Drone

Alex runs the program. Nothing happens on screen, but a hidden "Recon Drone" quietly deploys. To evade the firewall (security guards), it doesn't use a fixed address to contact the hacker.

Instead, it uses a "Frequency-Hopping Radio" strategy. Both the drone and the hacker’s server automatically generate and switch to new communication addresses simultaneously. Like two spies perfectly in sync, even if a firewall blocks one address, the drone has already jumped to the next.

Act III

The 1GB Disguise

With the connection established, the drone summons the ultimate burglar: StealC 2.0. To sneak past the Antivirus checkpoint, StealC 2.0 uses a genius trick: it inflates its file size with useless junk data until it weighs a staggering 1 Gigabyte. Why? Because most traditional Antivirus software are programmed to skip scanning extremely large files to prevent the computer from slowing down. Assuming the giant file is harmless, the scanner simply waves it through: "Too big to scan, keep moving!"

Act IV

The Ghost Heist

Having successfully bypassed the antivirus, StealC 2.0 now has free rein. It immediately breaks into Alex’s web browser, aggressively vacuuming up his private data—saved website passwords, login cookies, and crypto wallets. It packages all this sensitive information and ships it directly to the hacker's command server (C2). Once the loot is secured, the virus hits a self-destruct button and vanishes into thin air.

By the time Alex realizes his digital life is compromised, the crime scene is spotless.

"This isn't just Alex's personal nightmare. When a compromised developer connects to your corporate network, a localized theft instantly escalates into a full-scale business crisis. "

Incident Overview

Sangfor Farsight Labs recently uncovered a sophisticated software supply chain attack that utilizes phishing as its primary delivery method. A financially motivated threat actor poisons the development ecosystem at its source by masquerading as legitimate, highly-rated tools on GitHub. This deceptive phishing lure is specifically designed to bypass initial security awareness filters and trick IT professionals into introducing malicious code into their environments.

The Target: Developer Endpoints

The campaign specifically targets developers, as these users serve as high-access gateways to an organization's most sensitive assets:

• Elevated Network Privileges: These users often have broad access to internal administrative systems.
• Cloud Infrastructure Keys: Attackers seek credentials and access tokens for platforms like AWS or Azure.
• Critical Source Code: Exposure of proprietary code can lead to intellectual property theft or further exploitation.

Because of this high-level access, the compromise of a single developer endpoint can rapidly escalate from a localized data theft into a catastrophic enterprise-wide breach.

Key Technical Highlights

1. Using GitHub as a "Safe House"

With DevOps becoming so popular, attackers now use GitHub’s own features to launch attacks. They treat GitHub as a safe place to hide their malicious files and commands. Since most firewalls trust GitHub, this hidden communication easily slips through without being blocked.

2. Binary Padding to Evade Antivirus

After the malware is downloaded, hackers modify a file named lua.exe. Once it runs, it immediately grows its own size to over 1GB. This "bloating" trick helps the malware hide from antivirus software and makes it much harder for security experts to analyze. It shows the attackers are very careful about not being caught.

3. Constantly Changing Server Addresses

The malware is very "clever" about how it talks to the hackers. After stealing your data, it sends it to a remote server. However, the attackers use a self-update feature to constantly change their server's address. Even if a firewall blocks one address, the malware simply switches to a new one to keep stealing or selling your data.

4. Automatic Exit Based on Location

When the software starts, it first checks the user’s language and location. If it detects that the user is in certain countries, the malware will automatically shut itself down and stop all further actions.

TTPs Analysis

Recommended Actions

• Add these known malicious URLs and IPs to your existing firewall or antivirus blacklist.
  
  Github Phishing Address
  https://github.com/IgorDevApp/apt-intelligence-dashboard
  https://github.com/IgorDevApp/IgorDevApp
  https://github.com/IgorDevApp/PasswordSecurity
  https://github.com/IgorDevApp/Calculadora
  https://github.com/Markusino488/cve-2025-8088
  https://github.com/Markusino488/APKEditorPro
  https://github.com/amergamer/BOF_Spawn
  https://github.com/hrefcoder/Nextjs-RCE-exploit-kit

Malicious IP Addresses

• Secure Browser Credentials: Avoid storing sensitive passwords directly in the browser, as infostealers specifically target these databases. Use a dedicated, encrypted password manager and regularly clear browser cookies to invalidate stolen session tokens.
• Replace Legacy AV: Transition from signature-based Antivirus to behavior-based solutions (such as EDR) that monitor for anomalous process execution. This ensures protection even when a file's size or "junk data" allows it to bypass traditional static scanning.
• Zero-Trust for Developer Workspaces: Implement stringent application allowlisting and containerized environments (like VMs or Docker) for testing unverified open-source tools. Developers should never execute untrusted code on a host system that contains enterprise access tokens or active session cookies.
• Get a Free "full body health check" with Sangfor Security Evaluator: Prevention is better than cure!

IoCs

We provide IOCs for blocking, but threat actors change them daily. Real security goes beyond blocking known indicators; it relies on advanced threat detection to catch malicious behaviors and prevent future attacks.

Archive Files

Other Files

Addresses

Sangfor Farsight Labs is dedicated to tracking and analyzing global advanced threat landscapes. By leveraging its robust automated attribution and external monitoring systems, the lab delivers rapid, precise analysis and cross-correlation of APT attack samples. Having archived comprehensive profiles on dozens of APT and cybercrime entities, Farsight Labs has a proven track record of helping clients successfully mitigate high-stakes APT and cybercriminal incidents through expert incident response. In an era of escalating security conflicts and evolving TTPs, Sangfor’s Advanced Threat Team is committed to continuous vigilance and the rigorous research of new global security threats to ensure proactive defense.

Frequently Asked Questions