BLOG

The OpenSourceMalware Show #26

GlassWorm compromises the OVH CLI, compound payloads evade detection, and GhostAction copycats PolinRider

By cb482791-4ef1-4762-96ad-b0ca4bdd538e ·

The OpenSourceMalware Show #26

The OpenSourceMalware Show is available on YouTube, LinkedIn, and as a podcast.

This week we talked about:

OVH CLI compromised by GlassWorm: GlassWorm is back. The Russian threat actor went quiet after its infrastructure was taken down earlier this year, and it resurfaced with malicious versions of OVH’s official CLI tool. It got in through a contributor account it had held for seven months, a reminder that compromised credentials can be used long after they’re stolen. The malicious builds came from a laptop rather than OVH’s normal pipeline, which helped a user spot them quickly.

Compound payloads: Threat actors are splitting malware into pieces, often spread across several packages. They only do damage when they run together, and the purpose is to evade detection because each piece looks harmless on its own. DPRK is using a similar approach in Contagious Interview, in which a private repo’s .npmrc points to a different registry, so the malicious package only resolves for the target.

GhostAction copycats PolinRider: GhostAction has moved from attacking CI to going after developers directly. It used its malicious workflows to plant PolinRider’s fake font trick in repos already compromised with the malicious workflows. Anyone who opens one of those repos in VS Code runs a credential stealer and gets a cron job that checks in with the attacker every five minutes. Removing the malicious workflows doesn’t remove it, and at least one maintainer who did exactly that missed the new malware. Luckily, the code is sloppy and only partly works, but that doesn’t make it harmless.

Resources

[00:00:00] Jenn Gile: Hello. We are live on October 21st. I- we’re recording at a slightly different time than normal. I happen to be in Europe this week, so, uh, we’re not recording at our normal time 'cause I like sleep. Um, we’re gonna be talking today about the OVH CLI compromise, some evolutions that we saw with GhostAction this week, and, um, a new trend that we’re picking up in our research.

[00:00:29] Jenn Gile: But before we get into that, Paul, what’s going on?

[00:00:34] Paul McCarty: Yeah, I mean, I think this is a very different time. It’s different, it’s a different day. It’s a very, very different time. It’s the middle of the week versus the end of the week for me, so very different. But, um, yeah, I mean, this is what happens when you have to align schedules for people that are on almost opposite sides of the planet right now.

[00:00:50] Paul McCarty: You’re not quite fully opposite from me or me opposite you, but pretty dang close. So it is what it is, right? Um, good to see you.

[00:00:57] Jenn Gile: Yeah. It’s, it’s been interesting, uh, working this week on a, a totally different rhythm. Um, I’m used to being, uh, you know, the first thing that I do in the morning, catch up with whatever Paul’s been up to, but, uh, now it’s catch up in a different way.

GlassWorm hijacks the OVH CLI after seven months of dwell time

[00:01:13] Jenn Gile: But anyway, uh, I’m in Barcelona this week, uh, for work. Been really enjoying getting to know the Catalan culture and people. Uh, so if you’re from Barcelona, hey, great city, beautiful place. Went to Montserrat yesterday. Okay, let’s get into- Nice … OVH. So, uh, what, two days ago, um, OVH was hacked via, what I would I’m gonna go out on a limb here and say somewhat ancient, uh, credential compromise from the spring.

[00:01:49] Jenn Gile: And when I say ancient, I mean these credentials were stolen seven months ago, uh, which in software supply chain security is a long time. But you and I and some people in the community have been talking about why a threat actor might wait so long before compromising something like OVH. And, uh, the net of it is if you do these kind of, what we would call in the US, there’s probably another way to, to put this, but like a shotgun approach, just, you know, fire and see what you hit.

[00:02:20] Jenn Gile: You kinda have to go out and then, like, hunt and see what did you hit. And so the threat actor probably had a lot of data to sift through, uh, you know, probably did some testing to see what’s still live, you know, what are, what’s the possible- Right … blast radius if I compromise this thing? Um, so the, the OVH credentials were stolen, you said about six months ago.

[00:02:44] Jenn Gile: Uh, this was one of the things you found while I was sleeping, so tell me what I missed while I was asleep.

[00:02:49] Paul McCarty: Yeah, I mean, I, I actually don’t know when the credentials were stolen. Um, and it’s funny to kinda go backwards. I, it wasn’t you and I, but it was somebody else and I were like, just a couple days ago, we were talking about what happened to GlassWorm.

[00:03:01] Paul McCarty: We haven’t heard from them for a while. GlassWorm, by the way, for catching everybody up, um, is a Russian, um, uh, threat actor, um, who in 2025 was doing, um, some stuff that was kind of similar to PolinRider and some… Anyhow, um-

[00:03:19] Jenn Gile: Well, and there was a big takedown earlier this year of their infrastructure, and so we haven’t-

[00:03:24] Paul McCarty: There was

[00:03:25] Jenn Gile: seen anything really related to GlassWorm since that major infrastructure takedown, maybe back in, like, uh, May or June or so

[00:03:34] Paul McCarty: Yeah, so basically I woke up, I, timing was just really, really good for me. Like, I saw it happen in almost real time, and so I jumped on it and nobody else was working it. And, um, you know, I mean, OVH, uh, just some background.

[00:03:47] Paul McCarty: So OVH is a, is a, a French-based VPS, virtual private server, company. They’ve been arou- around forever and a day. Jenn and I were just talking about this. There’s two big ones in Europe that I can think of. One is OVH and the other one’s Heinziker. Um, but, um, basically what happened is they have a CLI that allows customers interact with assets and resources in the OVH cloud.

[00:04:09] Paul McCarty: Um, and same thing like a DigitalOcean’s got and Vultr’s got, and AWS has got, and everything else, right? Um, and the, the CLI tool for OVH was compromised. Four, four versions of it were compromised. Um, and the, uh, original push, force push for the compromised developer, um, HassenBF, was back in… I, like I said at the top of this, we don’t know when his creds were stolen, but when GlassWorm pushed the initial payloads into those four GitHub repos that I mentioned in the blog post, that happened March 5th, which is like seven, seven months ago.

[00:04:54] Paul McCarty: So old mate Hassen, you might wanna look at your repos a little bit more closely, but I mean, for whatever reason, uh, you know, they had dwell time that long. Um, and, you know, you said it, like their GlassWorm’s infrastructure got taken down. So I, I, I guess they just, it took 'em a while to take a look and see what was still live, like you said, and they found that this guy’s creds were still live.

[00:05:16] Paul McCarty: Um, and, uh, yeah, the rest, as they say, is history. This did not happen in GitHub Actions. These were built, um, if I’m, I’m, I hope I’m not mistaking the two, but if I remember correctly, um, these were built off, yeah, they were. These were built on, um, Hassen’s laptop, so they weren’t built in, in the CI environment.

[00:05:37] Jenn Gile: Yeah, it was outside of the regular pipeline, which I think is probably why it got taken down so quickly, is they, as we’ve seen with other compromises, account takeover style compromises this year, when the threat actor publishes through a method that’s not the typical avenue- Mm-hmm … you know, if you have some kind of alert structure set up, it’s pretty obvious when there’s a problem.

[00:06:02] Paul McCarty: Yeah, and, um, you know, we have, we have a community member to thank for finding it. Um, I, I, I can’t remember the, the user’s name off the top of my head, but basically somebody was using the CLI and saw there was a new version of it and, and realized really quickly that it was doing something weird. And, um, you know, a bunch of people took over, um, from that point.

[00:06:22] Paul McCarty: I saw the CEO while I was working, I saw the CEO post saying, “Hey, we’ve done incident response.” So I wrote back, “Hey mate, uh, you might wanna look at your incident response because this guy, um, who has a long-standing kind of, you know, contributor relationship with, with the OVH CLI,” which is open source obviously, um, “is still compromised.”

[00:06:41] Paul McCarty: Um, and I checked earlier today and the pre-installs were still there earlier today. I haven’t checked since then, but, so yeah, fun times.

[00:06:48] Jenn Gile: Yeah, you know, it, uh, it sparks some thoughts for me about open source business models. As you know, and some people know about me, I used to work for NGINX, another, uh, widely used piece of open source that nobody knows the company owns.

[00:07:03] Jenn Gile: So, you know, there’s kind of this interesting relationship when there’s a company behind an open source project that is also accepting external contributions to said project. Uh, I hope OVH doesn’t over-correct in their incident response and their, you know, security next steps and decide to no longer accept external contributions, for example.

[00:07:28] Jenn Gile: That could really Change the way that that project and that community works. Uh, you know, coming again from NGINX, uh, we didn’t accept a lot of external contributions, and that had more to do with the complexity of the tool and the need for stability. Right. But there was always that, like, tension with the community wanting to be able to contribute more to the project.

[00:07:51] Jenn Gile: So I’ll be interested to follow what OVH decides to do with regard to external contributors who may not be, um, at the same… Like have the same security standards as the company contributors themselves.

Signing your commits precludes a lot of malicious behavior

[00:08:07] Paul McCarty: One of the things that I s- saw that I was really disappointed with, um, is that, uh, I’m just verifying right now.

[00:08:15] Paul McCarty: The, um… Oh, maybe it wasn’t OVH. It’s not OVH. A lot of the, a lot of the open source projects I’ve been looking at lately that have, that have had compromised assets, and there’s been a, a bunch over the last two or three weeks, their… It, it seems like a lot of their commits are unsigned. And I’m thinking…

[00:08:32] Paul McCarty: Now, I get that using agents com- complicates this, and so you often will see, like if you’re looking at, like commit history, you’ll see, like verified when they do an actual push as a human, right? And then they’ll, you’ll see, you know, an unverified, unverified as their agent pushes for them. But, um, I, you know, I think that I’ve said it here before, like signing your commits is like one of the most powerful things you can do to prove- Yeah

[00:08:56] Paul McCarty: and attest that you, you know, or your account, you know, pushed that thing. Now, it doesn’t mean that everything else that, you know… But that precludes a lot of malicious behavior right there, and I just really wish people… I’ve been harping on about this for like, I swear to God, 10 years or more. Like, sign your commits.

[00:09:14] Paul McCarty: If you’re building in public, on public, sign your freaking commits. It’s not that hard, and it, it provides so much value, and require that you need it. Now, here’s the problem, Jenn. As we were talking about last week, a lot of the things that, that GitHub has put in lately, you know, push protections and, and whatnot, you know, those don’t work for these, these public, uh, repositories, and so you can’t enforce certain things.

[00:09:38] Paul McCarty: I think you can enforce… I, I, if I’m not mistaken, I think you can enforce- I think

[00:09:42] Jenn Gile: you

[00:09:42] Paul McCarty: can enforce- … commit signing …

[00:09:43] Jenn Gile: signed commits.

[00:09:44] Paul McCarty: Yeah. Yeah. I think you can It’d be silly if you couldn’t, right?

[00:09:48] Jenn Gile: Well, lots of silly things. Lots of sillier things have happened. Okay, not on the agenda, but I think it’s worth, like, maybe 30 seconds to a minute, because you and I were talking about it earlier.

[00:09:57] Jenn Gile: It’s open source. Deno was acquired by Cloudflare. Oh, yeah. Um, so kind of an interesting, you know, another open source project, uh, is going to be changing in a major way. For people who don’t know, Deno is ostensibly a way to do JavaScript without having to bring in all the packages. It kinda, like, lets you call out at runtime to different things.

[00:10:23] Jenn Gile: Um, the concept is that it makes it lighter weight, uh, you know, less work, those kind of things, you know, better performance. But the flip side that we’ve seen is that’s also a great way to, um, be sneaky about where you hide your malware, because if you’re calling runtime- You beat me to it … dependencies I mean, if you’re calling runtime dependencies, those can swap out.

[00:10:45] Jenn Gile: You know, y- you evaluate the package, but you don’t evaluate… Or even if you do evaluate the runtime dependencies. Anyway- Right … long story short, I don’t think we know a whole lot about the acquisition of Deno, but certainly the community that uses Deno is very concerned about it. And as I’ve seen lots of acquisitions over the years, big company acquires an open source project, things will change.

[00:11:09] Jenn Gile: Like, that’s Inevitable. Um, whether that means people move away from Deno, who knows?

[00:11:18] Paul McCarty: Well, I think they’re gonna have to. Like, I mean, it sounds like the, the, I mean, for tools like OpenTofu- It sounds like they’re making

[00:11:22] Jenn Gile: major changes to it.

[00:11:24] Paul McCarty: Yeah. I, I mean, this ecosystem’s imploding and, I mean, uh, there’s no other way for me to really think about it.

[00:11:28] Paul McCarty: Like, by this time next year, it’s effect- it’s not gonna be working, right? Between updates and the Deno Land stuff being taken offline, it’s, you know, it’s almost- Well, in

[00:11:39] Jenn Gile: reality, someone’s gonna fork it, and a fork- Mm-hmm … you know, this will be OpenTofu or, uh, you know, the open, the Terraform OpenTofu, OpenTerraform, uh, whole thing that happened, I don’t know, three to five years ago.

[00:11:52] Jenn Gile: Time’s funny.

[00:11:54] Paul McCarty: Well, I mean, there’s, I don’t know that much about… I know more about Bun than I do about Deno, but like, there, I mean, there are some actual infrastructure assets there too as well, like, you know, Deno Land and, you know- Fair … where you pull that, that, that CDN that they use. You know, y- not, you, so you’d have to fork it and replace that or take over that.

[00:12:11] Paul McCarty: I think it’s interesting too, like, I mean, like, so Deno was a project started by, um, Ryan Dahl that wrote Node to kind of, um… I, and this is my words, not Ryan’s, and so I don’t wanna, I don’t want to, um, offend him, but I think in, you know, and I think he said it kind of in his own way before, but it was his way of kind of righting the wrong, the wrongs that he did with Node.

[00:12:34] Paul McCarty: And, and when he wrote Node, you know, we never knew what was gonna happen to Node and NPM, and become this huge, you know, the largest software registry on the face of the planet, and the holder of all things malicious between GitHub and NPM. I mean, that’s, like, 99% of the malicious stuff out there. Almost said a bad word.

[00:12:50] Paul McCarty: Um, anyhow, so Ryan, you know, like, he built this thing and, and, and lately in the last six months, Bun has just kicked its booty. Like, it’s just, you know, Bun has become much more popular. With, with malicious actors too as well, I, I remind everybody the Mini Shai-Hulud, you know,

[00:13:04] Jenn Gile: he- Well,

[00:13:05] Paul McCarty: and let’s

[00:13:05] Jenn Gile: not forget Bun was also acquired.

[00:13:08] Jenn Gile: Yes, sure was. So interesting things happening at the runtime JavaScript, the alternative universe.

[00:13:16] Paul McCarty: It’s really hard to make money in that space because people don’t wanna pay for it. They just think you can do it for, you know, like interpreters, like-

[00:13:21] Jenn Gile: Commercializing open source is really hard, and when you look at companies that have tried to build a commercial product on top of their own very popular open source project, NGINX included, um, it’s a very small percentage of people who need the commercial version and, or are willing to pay for a commercial version.

[00:13:43] Jenn Gile: And I think what a lot of- Companies and salespeople lose sight of is that the expectations of the core open source project, um, change over time and evolve over time, and the people who are using that core open source project continue to expect that that project improves over time. And what I tend to see when open source gets commercialized is there’s this desire to kind of leave the open source project as the, the not great alternative.

[00:14:17] Jenn Gile: You need, like, a, a, a reason to upgrade to the commercial one. And often, I’m going somewhere with this rant, uh, often one of the things that gets added in the commercial version is something related to security.

[00:14:29] Paul McCarty: Yeah, which sucks.

Compound payloads split malware into pieces that each stay under the detection bar

[00:14:32] Jenn Gile: Yeah. Anyway, um, I wanna take things slightly out of order because we went down this rabbit hole on open source- Sure

[00:14:40] Jenn Gile: and we’re talking about, um, different ways to sneak malware in. You know, we talked about runtime. Uh, we’ve been seeing a trend, which I don’t know that we’ve talked about on the show yet, of what we would call compound payloads. Uh, so there’s, like, different ways that threat actors are evolving right now to make the malware more difficult to find in malicious open source because they’ve realized if you put it right in the project, anyone with, you know, a decent agent or, uh, a tool like ours or a scanner is probably going to find it.

[00:15:18] Jenn Gile: It’s getting … You know, you look for these little tip-offs. Does it have a pre-install script? Does it have a post-install script? Is it calling Bun? Is it telling you to install TruffleHog? Oh, gosh, this might not be good. And so they’re finding ways to, uh, hide where the payload is, and one of them that we were just talking about was hiding it in a runtime dependency.

[00:15:40] Jenn Gile: But this other way, this compound payload, is exactly what it sounds like. It’s like a Transformer or a, what did we say last week? Um, Power Rangers or something. Like, they all com- Uh, what’s the evil version?

[00:15:52] Paul McCarty: Well, V- V- Voltron was- Voltron.

[00:15:54] Jenn Gile: Yeah.

[00:15:54] Paul McCarty: Voltron, yeah.

[00:15:55] Jenn Gile: Sorry, I can only think of the good ones. The … You know, the, the separate pieces come together to form the malware.

[00:16:01] Jenn Gile: And, um-

[00:16:02] Paul McCarty: Wait, Voltron wasn’t bad. Voltron w- they were good. They were good.

[00:16:05] Jenn Gile: Yeah. Yeah, sorry.

[00:16:05] Paul McCarty: They were good. J- just to be clear-

[00:16:07] Jenn Gile: Yeah, but

[00:16:08] Paul McCarty: that’s the good one … as a Voltron, as a Voltron fan from the, from the '80s

[00:16:12] Jenn Gile: There’s always a bad version. This is the bad version. So we’ve got a package that you- Oh, yeah … were looking at earlier this week.

[00:16:19] Jenn Gile: Uh, now I lost it.

[00:16:22] Paul McCarty: Yeah, webrunc.

[00:16:23] Jenn Gile: webrunc, yeah. I, I look at this package- Wow … and I think we brunch and it makes me hungry. Um, webrunc, and I don’t think this is like a… There’s not like, you know, danger flags. This is more of a scientific, this is an interesting thing. So it’s a PyPI package that we found with our sort of forward hunting, um, automation.

[00:16:45] Jenn Gile: It doesn’t pull a secondary payload or include an exfil destination, so there’s no malicious component in the package itself. However, what you were seeing is that it appears to have been intended to run in conjunction with other packages that complete a malicious payload. And so it’s got a fetch and execute pattern in it, which is retrieving some, uh, remote content.

[00:17:09] Jenn Gile: You know, s- uh, as you said in the, the writeup on it, it’s got a bit of a dropper, loader, attacker module, uh, model. So, um, what’s- Yeah … what’s interesting about this, um, what do you want people to understand about this kinda new- Well- … new way?

[00:17:27] Paul McCarty: What, why are bad guys doing this? You, you kind of alluded to this s- you know, a minute ago.

[00:17:31] Paul McCarty: Bad guys are doing this because, you know, people, you know, the companies like OSM and Socket and Aikido and everybody else are getting better at finding the bad stuff, right? And so when you, when you build a detection engine, I don’t wanna go into too much detail 'cause I don’t wanna spill the tea for the bad guys, but the, the reality is that talking about it at a high level, when you’re building a detection engine, you can’t just accept what…

[00:17:54] Paul McCarty: Like, a lot of, um… Oh my gosh, this, this is a great segue into something else I came up with today, Jenn. Uh, this is totally YOLO. I came up with an acrym- acronym today, PEST, Potentially Exploitable Security Tool, and here’s, uh, like I’m, I’m gonna- I like it … these, I’m seeing a t- I, I’m seeing a ton of these right now.

[00:18:12] Paul McCarty: So basically, in the age of vibe coding, some person that doesn’t have a background in building security tools or in coding- uses a v- uh, uh, an agent and builds, you know, a security scanner, right? And there’s just a plethora of these. They’re just popping up everywhere. And a bunch of them are actually malicious too, they’re hiding malicious stuff, but most of them are not.

[00:18:32] Paul McCarty: Um, where was I going with this? The, um, uh, when they’re building these potentially exploitable security tools, they will often use YARA the first time around because that’s what the agent will say. “Well, use YARA.” And so it’ll be, in YARA, you know, you’ll have, I don’t know, maybe 20 or 30 rules that you can find, you know, out in the, in GitHub world, and you use those.

[00:18:54] Paul McCarty: And you’ll detect stuff, right? And you’ll detect these, like, kind of one-off behaviors or signals. Really quickly though, you’ll figure out, oh, schnikes, there’s just a ton of false positives. I’m spending all my time triaging all these. And so as your maturity in, you know, as working with your scanner grows, you’ll start to realize I can’t just take one signal, I have to take multiple signals, right?

[00:19:16] Paul McCarty: And I have to combine those together until they hit some sort of, you know, trigger value, and then I’m gonna say, “All right, this is potentially malicious. I need to pop this over to a AI judge,” or whatever the case may be. Why I’m saying all this is that bad guys know that, and so what they’re doing is they’re, they’re kind of chunking, right?

[00:19:33] Paul McCarty: Or sharding their… I love using sharding. Um, they’re sharding their, um, their payloads up into three or four pieces, sometimes more, um, so that it doesn’t, it doesn’t ever hit that kind of, that trigger value where- Right. Each

[00:19:49] Jenn Gile: individual thing is, like, maybe a little sketchy, but not sketchy enough to hit the, the bar- Yeah

[00:19:55] Jenn Gile: for this is malware.

[00:19:57] Paul McCarty: Here’s a great example. Going back to our CLI, right? The OVH CLI and all. Every CLI that has to do stuff, the first thing it does is it imports .env, and so it can, so it can access environment variables, right? That’s, that’s what CLI tools all do, right? And if you just use these YARA rules and be like, “Oh my God, it’s loaded .env, it’s malicious,” and really quickly you realize, oh my gosh, 99.9% of the time it’s just a CLI doing what a CLI is supposed to do.

[00:20:23] Paul McCarty: W- so what they’ll do is they’ll build one package that just does that part, and then it’ll call, in a sneaky way- Hmm … a dependency that does the other. Now, typically, what you wanna do is you wanna have one umbrella package that calls out to these separate things. And we’re seeing DPRK doing this right now, actually.

[00:20:39] Paul McCarty: 'Cause what you

[00:20:40] Jenn Gile: don’t wanna do is- Well, we talked about this, I feel like, a couple months ago, of, you know- Yeah … the, the pros and cons of this approach, right? Uh, you have to have that umbrella package. You have to have the sub-packages. Yeah. And if one- Yeah, you- … component gets killed, then you gotta update the rest or find an alternate way to get your payload to work.

[00:21:01] Paul McCarty: Here’s my crazy meta- here’s a Paul metaphor, a classic Paul metaphor. It’s like you’ve got the octopus and the eight arms, and basically what happens i- if me or somebody else identifies the umbrella, right, you, you chop the head off the, the umbrella, the octopus, they all- You just got a bunch

[00:21:15] Jenn Gile: of flailing arms.

[00:21:16] Paul McCarty: Yeah. You got all the arms. You can just come along and put another head on it, and the arms just go whoop, you know? Yeah. Voltron. There we go. Octopus, Voltron, um- I’m getting kooky here 'cause it’s late. Um, but that’s the reason they do that, to make it portable, and that’s a really- Mm-hmm … the modularity and the portability of this.

[00:21:33] Paul McCarty: So if that umbrella one that kind of combines these things. Now, what I have also seen is I’ve seen, like, two packages doing the umbrella work and they’ll call out, um, but you typically are not gonna see, um, the one doing the… You know, there’s like a, there’s gonna be an exfil, there’s gonna be the credential grabbing, and there’s gonna be the exfil at the beginning and the end, right?

[00:21:52] Paul McCarty: This is the sink and the source. Um, and then there’s gonna be some other stuff in between if there’s persistence or whatever. Um, and all those different kind of things have to be kind of grouped together under the umbrella package or the thing that calls it. DPRK, just a couple weeks ago, started doing something new, which I, I, this was not in the thing, but I’m gonna say it.

DPRK hides Contagious Interview payloads behind a private npm registry

[00:22:09] Paul McCarty: It’s actually, it’s another kind of evolution of compound packages, which is for Contagious Interview, like, like old school Contagious Interview. Which by the way, I know PolinRider is very successful. DPRK is still actively doing proper old school Contagious Interview, i.e., hitting you up on LinkedIn, "Hey, I’ve got this great job in crypto or whatever.

[00:22:29] Paul McCarty: Are you interested?" And what they’re doing, Jenn, is they’re sending you a, um, a invite to a private repo, right? Um, and you, uh, you join that private repo and then part of it is to download an NPM package, and basically in the private repo there’s an npmrc that points at a different, um, NPM registry. So when you install the NPM package, in the package.json there’s a file getting, there’s a package getting called out that’s not in the public registry.

[00:22:59] Paul McCarty: You’re like, “What is this?” Right? And it just bypasses it 'cause it can’t install it. But if you have the, if you have got the repo already installed that’s got the npmrc, and then you run the NPM install in that directory structure that has access to that, then you get the malicious payloads. Very smart.

[00:23:15] Jenn Gile: Wow.

[00:23:15] Paul McCarty: But, yeah, but- That’s crazy … there’s a bunch of things, there’s a bunch of things that can go wrong, right? Like they, they have to… And it require- It’s Contagious Interview, so there’s like, you know, somebody in, in Pyongyang or somewhere else has to be like managing all this and getting you to do the invite.

[00:23:30] Paul McCarty: There’s a lot of like fiddly stuff, and that’s why they, they are mostly moving to automation like PolinRider. But this Git repo beforehand, that’s, that’s like the jab that kind of gets you going and then the, the, the left hook is the NPM package that then, um, calls out to this thing that doesn’t get resolved otherwise.

[00:23:49] Paul McCarty: It’s really smart.

[00:23:50] Jenn Gile: It is smart. Definitely. Well, you know, the thing that comes to mind here is they’ve introduced dependencies to their process, and like we see with any developer, you make a change to a dependency that introduces unexpected behavior, and you have breaking changes. So, uh, I wish them nothing but breaking changes.

[00:24:12] Paul McCarty: I have something I- well, you and I will talk afterwards 'cause I I got some tea about, uh, but I don’t wanna say it here.

GhostAction copycats PolinRider with a fake font file

[00:24:19] Jenn Gile: Okay. Well, why don’t we move on to our last topic? Let’s do it. Uh, late last week, it would’ve been Friday, no, Thursday Last week, uh, we got hit up on our, um, internal community by one of our community members, Thijs from Jamf, who is just, like, a fantastic member of our community.

[00:24:39] Jenn Gile: He’s always doing hunts- He might be awake

[00:24:41] Paul McCarty: right now too, as well.

[00:24:43] Jenn Gile: Oh, you’re right. He might be- He probably is awake. I’m in his,

[00:24:45] Paul McCarty: uh, timezone I meant to, I meant to reach out to him. I meant to reach out. Should have told him. If you’re, if you’re listening, mate, I meant to reach out to him, but because that whole login thing that happened before this, Jenn, I didn’t get a chance to reach out to him.

[00:24:54] Paul McCarty: Sorry, sorry, inter- I inter-

[00:24:56] Jenn Gile: interrupted. That’s okay. Anyway, so Thijs reached out. Uh, he was doing a regular hunt for compromised repositories, looking for PolinRider indicators. Uh, he found a group of them, and normally he would just report those and move on. But, uh, he looked at the payloads in them to, you know, make sure they weren’t false positives, and he saw something weird.

[00:25:18] Jenn Gile: Um, normally what you see in these, uh, what he had flagged was something like 94 compromised repositories, which had a VS Code, uh, tasks file, which auto-ran a fake font, you know, 400.woff whatever file. Uh, sounds familiar, right? And so- Mm-hmm … he thought, “Bam, that’s PolinRider.” But then when he looked at the fake font file, instead of seeing the classic obfuscated JavaScript that we’ve come to expect with these files, he just saw plain old JavaScript plopped in there, no white space, no attempt to hide it, and it didn’t look anything like what he knows our PolinRider stuff looks like.

[00:26:02] Jenn Gile: But what he did see was the IP address that- Zz, zz … yes, zz, zz, zz, that, uh, GhostAction has been using. And so if you’re not up to speed, GhostAction is a campaign that, or a threat actor, or both, um, that’s been around for about a year and had a resurgence in the last month. We reported on it in last week’s show.

[00:26:25] Jenn Gile: Um, they had started pushing malicious, uh, GitHub Actions workflows. They had started, um, phishing open source maintainers. Well, Thijs pushed this over and he said, “Hey, it’s weird. You guys should take a look at it.” And so I took a look at it, and indeed it is weird. Um, it is definitely GhostAction. I went and did some Git forensics on the compromised repositories and found the sequence of events was essentially the- They got compromised first by the GhostAction malicious workflow.

[00:26:59] Jenn Gile: And then, uh, the threat actor used that to push this PolinRider style malware into their repository so that they could maintain persistence as well as infect others, because that’s what this particular vector does, even if the malicious workflows, um, were removed. And coincidentally, the first repository that I investigated, um, the maintainer actually had gone in and removed the malicious workflows but didn’t realize that the new malware was there.

[00:27:32] Jenn Gile: So I did, um, submit an issue. I should follow up and see if they saw it and removed the malware. But essentially, what we’re seeing is a copycat, and it’s pretty clearly not, uh, DPRK because, gosh, I don’t have a nicer way to put this, but it wasn’t especially sophisticated. Um, so the initial tasks file, you know, runs this fake font file.

[00:28:00] Jenn Gile: It has an info stealer that’s looking for something like seven different things. Uh, what do we have here? AWS creds, PyPI, NPM, Git credentials, um, Claude login, Gemini login, some, uh, Kubernetes stuff. So it’s looking for that sort of thing, uh, reads those files, uh, reads SSH private keys, and then it’s, um, grepping across the home directory for everything, you know, keeping the matches.

[00:28:29] Jenn Gile: Um, and then the second thing it does is it installs a cron job where it phones home every, I think it’s five minutes to see, you know, what’s-

[00:28:38] Paul McCarty: It is …

[00:28:38] Jenn Gile: what’s on the server, what else can we do? Um- Yeah … but the issue is the, um, the info stealer kind of doesn’t work. Which is-

[00:28:51] Paul McCarty: Pretty crap.

[00:28:52] Jenn Gile: Yeah, it’s, it’s, it’s not great.

[00:28:54] Jenn Gile: Um- I mean, it- So that’s-

[00:28:55] Paul McCarty: It partially works. It partially works.

[00:28:58] Jenn Gile: Yeah, it has a lot of issues, which I’ve outlined in the blog that I shared in the comments, so if you’re curious about that. But what this reads like to me, and I think you and I even talked about something similar recently, certainly I’ve been talking about it as I’ve been doing talks, uh, out in the community about PolinRider, is there’s just tons- Yeah

[00:29:16] Jenn Gile: of malware out on GitHub right now. And if you’re a threat actor- Mm-hmm … and if you’re not very experienced, and you wanna quickly iterate over a weekend, which is definitely what we saw happening in the GhostAction campaign a week ago, is, you know, they started with the workflow and then they started the typosquatted domain with the phishing.

[00:29:35] Jenn Gile: Mm-hmm. And then I, you know, pieced together the timeline. They were setting up this PolinRider component of the attack right around that same cluster and pushing it out, like, the day after they did the phishing. So this is all happening very closely. All they would’ve had to do is point an agent at one of thousands of repos infected with PolinRider and said, “Hey, you know, make something that’s kinda like this, but does, you know, these five things.”

[00:30:02] Jenn Gile: And I think that’s what they did here.

[00:30:05] Paul McCarty: And it, it used literally the exact path and name-

[00:30:10] Jenn Gile: Yes … of the first PolinRider- It installs that awesome files. Yeah. Uh, though it’s, uh, awesome font, sorry. It actually changed it a little bit in ways- It did … that are weird. Yeah. Uh, instead of all of .woff2 files, they’re all .tifs, except for the payload, which is, like, maybe you wanna change that one also, 'cause it would make it harder to find.

[00:30:30] Paul McCarty: There’s at least three different, like, kind of iterations of that.

[00:30:34] Jenn Gile: Yeah.

[00:30:34] Paul McCarty: Right? The one that I saw most was actually just one .woff2, which is the, the, the- Yes, I saw that

[00:30:41] Jenn Gile: as well …

[00:30:41] Paul McCarty: .woff2 400 file. It didn’t install the full suite. Yeah, so it didn’t install all the other fake, um, uh, font files. It just had that one, and it was exactly the, the original PolinRider .woff2 path, you know, regular 400 .woff2.

[00:30:58] Paul McCarty: So, um, good day, Cody.

[00:31:00] Jenn Gile: This is really coincidental. We’ve got somebody on LinkedIn asking, “Are people getting more aware of attack patterns and following suit, try to capitalize unknown successes?” That’s exactly what we’re talking about right now. Um, you know, people are aware of what is happening, uh, with these fake font files, and this is a great example of, hey, this thing works.

[00:31:22] Jenn Gile: People don’t look for this, you know, attack vector. You know, they already maybe use VS Code, so they don’t notice that the VS Code folder in their repo all of a sudden has an extra file in it. Um- You know, maybe they should notice that a public fonts folder is suddenly appearing as well. Um, most, I would say most, uh, repositories that I’ve seen, and Paul tell me if you’ve seen something different, that have the public fonts folder, they’re not already using that in the repo.

[00:31:58] Jenn Gile: It’s a, a net new- Yeah … addition to the repo.

[00:32:01] Paul McCarty: Yeah. 10-4. Yeah, it’s net, totally net new. Um-

[00:32:05] Jenn Gile: Yeah …

LLMs help inexperienced threat actors reach further, even when the malware only partly works

[00:32:06] Paul McCarty: you know, I think it’s not surprising that the, um, that the shape… So basically, like LLMs are really great at like, you know, “Hey, I wanna build this thing.” So it goes and grabs the exact path of like the PolinRider .woff2 thing.

[00:32:20] Paul McCarty: Like literally the exact same path. But then the content, as you mentioned, is totally different, right? It’s not, it’s not similar to, to what is in the PolinRider one at all. Because here’s where the LLMs, they’re like, “Ooh, I don’t wanna help you do this kind of stuff,” right? So you have to chunk it down- Mm-hmm

[00:32:36] Paul McCarty: in, in individual things. Like, you know, have, having done a lot of red teaming myself, the, you know, when you’re building these things with LLMs, you have to like, you know, chunk it down to like, “Do a function that does this.” 'Cause if you tell it what you wanna do, it ain’t gonna do it, right? So you gotta chunk it down.

[00:32:51] Jenn Gile: Oh, good

[00:32:51] Jenn Gile: grief. Half the time I can’t get it to read a blog about malware. Like

[00:32:56] Paul McCarty: Yeah, Jim Manico

[00:32:57] Jenn Gile: was talking about- The, the controls are pretty aggressive.

[00:33:00] Paul McCarty: Jim was on Twitter yesterday, last couple days, saying that, you know, if you’re having problems with blockages and refusals, it’s because you’ve done something wrong, effectively, that’s what he said.

[00:33:09] Jenn Gile: Uh-oh.

[00:33:09] Paul McCarty: And I was like, “No, mate-” I think

[00:33:10] Jenn Gile: we froze, but I don’t know if I froze or Paul froze.

[00:33:14] Paul McCarty: Uh, I was talking the whole time, obviously, so I… You froze for me, but,

[00:33:19] Jenn Gile: um- Okay, I’m back. Okay. Sorry, I missed that. You can continue on.

[00:33:23] Paul McCarty: Yeah, anyhow. Jim, Jim Manico was talking about, um, you know, like if you have problems with refusals or blocks, it’s probably on you, and he basically said it’s 'cause you haven’t signed up for stuff, or what are you using the wrong model.

[00:33:33] Paul McCarty: I’m like, mate, everybody I know that’s a researcher is having this problem. Everybody’s having this problem, right? So anyhow, that aside, getting back to the point about Cody’s question, like the, the, the shape of these things, the LLMs are real… They’ll, they’ll suggest, “Hey, why don’t you do this?” Right? But then when you get in the guts of it, actually doing the info stealing and doing the, the crypto stuff, the, the EtherHiding, that’s where it starts to, it’ll be like, “Oh, I don’t wanna do that,” right?

[00:33:59] Paul McCarty: And so that’s why, for example, this payload in the .woff2, only about 60% of it worked. You know? Like, um, it didn’t actually do things-

[00:34:06] Jenn Gile: Yeah, I’m gonna say, I’m not gonna say why, but looking at the tasks file, it was simplified in a way that made it less effective. So- Mm-hmm … who knows if that was the LLM being clever, if that was the threat actor not understanding what that code did.

[00:34:27] Jenn Gile: Um, regardless- And all of this together combined implies to me that this is an opportunistic person who is able to reach further because of LLMs rather than an experienced threat actor inspired by a, a fellow threat actor. That’s, that’s how this reads to me.

[00:34:51] Paul McCarty: Yeah. Well, it’s confusing. Like, I’ve said this, uh, you know, publicly several times, GhostAction confuses me and intrigues me because in some ways it reminds me a lot of TeamPCP.

[00:35:02] Paul McCarty: You had these people that were, like, very low technical capability, but in some ways punching way above their weight, right? And the same, and GhostAction, like, has actually pulled off … Like, I mean, they, they s- they hauled in a bunch of credentials from the first couple of iterations, you know, campaigns.

[00:35:19] Paul McCarty: Um, so, you know, and they’re using those now obviously. We’ve seen that, right? Um, but one threat actor has done, you know, GitHub Actions-based, um, you know, kind of Mini Shai-Hulud style attack, you know, worm stuff inside of the, the CI. Has also done look-like domain phishing. Totally different. Like, I’m gonna go as far away from CI-based attacks as possible and go over here to phishing land, right?

[00:35:46] Paul McCarty: Um- Mm-hmm They’ve come back and they’re, they’re, you know, mirroring DPRK- Targeting devs … Paul and I

[00:35:53] Jenn Gile: there.

[00:35:54] Paul McCarty: Yeah, like it’s all over the shop, and it’s just this is the world we live in. I am seeing so much malware. I was talking to one of my friends, you know, a couple days ago. Bad guys are, because they’re all vibe coding, they’re using C2 infrastructure like MySQL, and Supabase, and Postgres for their, for their C2, but then they have to include the username and password.

[00:36:16] Paul McCarty: And they don’t realize anybody else can use those username and password to see what you’ve hauled in, right? Like, it just- and they just don’t know because they just don’t understand, right? So, but that doesn’t mean that that hand grenade doesn’t explode and cause a company real damage. Even though the, the person writing it is a Muppet, right, and doesn’t understand what they’re building, doesn’t mean those things can’t have damage.

[00:36:36] Paul McCarty: So, um, you know, I have to be careful about my flippancy or, or… Is that what I’m trying to say? My- No,

[00:36:43] Jenn Gile: I think that’s right. You know- Yeah … uh, just because they’re immature doesn’t mean they’re not dangerous and not to be taken seriously, and you shouldn’t, um, be concerned about what’s happening. So let me ask you, Paul.

Audit what your GitHub Actions workflows are actually calling

[00:36:55] Jenn Gile: 100%. What would you tell people, 'cause we haven’t really talked a lot about GitHub Action workflows. What would you tell people in terms of, like, a preventative or protective action? This is not, like, the situation where you turn on commit signing and you’re fine, right?

[00:37:13] Paul McCarty: Yeah. I mean, uh, so GitHub has done a lot to, um, you know, to uplift the security of the CI, um, and of GitHub Actions in particular, but people are still using old motions, and, and that’s the problem is like, you know, like pwn requests, right?

[00:37:33] Paul McCarty: Like, people are using those old, uh, versions of the actions, um, uh, because they’ve been using 'em for years and years and years, right? And they, they don’t realize that that makes them, you know, susceptible and vulnerable to, to pwn requests. In the same way, you know, people have been, you know, using the same, uh, repository…

[00:37:51] Paul McCarty: Sorry, the same CI actions for years that have that GitHub path right there in, you know, in the, in the GitHub Action- Because they, they don’t know any better. That’s just been working for years. And so GitHub is scared to go and break this stuff, um, and because they don’t wanna break people’s CI, but they’re starting to do some of that, and I think that we’re, we’re slowly making progress.

[00:38:14] Paul McCarty: But I think something that you have to realize when you are building, you know, continuous integration in GitHub or GitLab or anywhere else, is that you’re just calling a bunch of, you know, Docker containers that you don’t have control of, of over, and then exposing your source code and a bunch of credentials to those.

[00:38:33] Paul McCarty: So, you know, how many people are actually looking at all those different things they’re calling and those different action stages, right? M- most people are not. So I think the first thing is like, become aware of what’s happening inside of your, your continuous integration, whether it’s GitHub Actions or anything else.

[00:38:50] Paul McCarty: That’s the first thing you need to do is just, like, understand what’s happening there, right? If you copy and paste something three years ago, you probably should come back and revisit it and understand what it’s doing, um, because then that will help you understand, do I need to make some changes here?

[00:39:03] Paul McCarty: Because there’s a whole bunch of things that you need to do, you might need to do depending on, you know, what’s happening inside your particular CI.

[00:39:10] Jenn Gile: Yeah, that’s great advice. I mean, you know, it’s one thing if you’re an individual developer running CI, but if you’re in a company and you have someone, you know, if this is not your thing, uh, your platform engineering team is pro- if you have one, might be involved, your security architects, you know.

[00:39:25] Jenn Gile: There’s probably some people who own parts of this to start to get together and just do an audit, see how it works, um, see what needs to be renovated.

[00:39:37] Paul McCarty: 100%. And, and the cool thing is now LLMs are really good at helping you understand, “Hey, take a look at my workflow files and tell me, you know, can, can I uplift them?”

Wrap up

[00:39:49] Jenn Gile: Cool. Well, on that note, uh, I think it’s probably time to wrap up, say good night to Australia, good day, good morning to, uh, Europe. And we’ve got one more wacky week of this because I’ll be at LASCon in Austin, Texas next week, and then I get to be home for a while. Um, but we’re kind of working out, uh, our recording schedule around LASCon, but that shouldn’t be an issue.

[00:40:16] Jenn Gile: I’m really looking forward to that conference. I’ve said it on the show before. I enjoy it. It’s just, like, a fun time with the community. Every time I go- Right … I meet people that, like, it turns out I’ll see them 10 other places throughout the year after that. Yeah. But, like, for whatever reason, I meet them at LASCon.

[00:40:31] Paul McCarty: It has the highest, I think you and I have said this before to each other, it has the highest density of high-quality AppSec people of any conference I’ve ever been to. Like, and in this crappy, you know, strip mall location.

[00:40:44] Jenn Gile: Oh, the, the location cracks me up. Um- I’ll say my one spicy thing on the way out. I think LASCon is what AppSec Global, uh, in the US should be.

[00:40:57] Jenn Gile: So I’m not going to AppSec Global this year. Uh, I’m gonna stick with LASCon.

[00:41:03] Paul McCarty: Yeah. Right on. Well, I, I have some FOMO. I really like LASCon a lot. I’m not wearing my shirt this week, but I was last week. Um, I do wanna, I, I, I know we’re signing off here, but one thing, uh, GitHub has released for a general preview their package firewall, and oh my gosh, I’ve had so much fun today messing with that and not doing what I should’ve been doing, but that’s okay.

[00:41:27] Jenn Gile: I can’t wait to hear all about it. Have a great weekend,

[00:41:30] Paul McCarty: everyone. Oh, you’re gonna, Jenn. You’re gonna. I’m stoked.

[00:41:35] Jenn Gile: All right, signing off.

[00:41:37] Paul McCarty: All right. Thanks, guys. Appreciate you listening. Bye-bye.