ForceMemo Hijacks GitHub Accounts, Backdoors Python Repos

ForceMemo is an active software supply chain campaign that compromises GitHub accounts and backdoors Python repositories via force-pushed commits appearing legitimate in the web UI.

The campaign utilizes the GlassWorm’s stolen-token ecosystem and employs the Solana blockchain for command-and-control (C2) communication, complicating detection and takedown efforts.

The attacker targets various Python projects, including:

Django applications Machine learning research repositories Streamlit dashboards Flask APIs GitHub-installed packages executing setup.py , main.py , or app.py during installation or runtime

StepSecurity’s threat intelligence team is monitoring ForceMemo as an ongoing operation that has compromised numerous GitHub accounts, injecting identical Python malware into multiple repositories since March 8, 2026.

Developers running pip install from a compromised repository or executing cloned code will trigger the malicious payload.

ForceMemo exploits stolen developer credentials from the GlassWorm malware, which is distributed via malicious VS Code and Cursor extensions. The malware searches for GitHub tokens in credential helpers, editor storage, and environment variables before exfiltrating them to attacker-controlled infrastructure.

Once a GitHub account is compromised, all repositories associated with that account are typically affected, indicating account-wide rather than repository-specific targeting. Evidence of this campaign includes automated backdooring of repositories under accounts such as BierOne, wecode-bootcamp-korea, and HydroRoll-Team.

ForceMemo utilizes git history rewriting instead of visible malicious commits or pull requests, making detection challenging. The attacker uses the account's own credentials, causing the push to appear as if it originated from the repository owner.

The injected Python code is heavily obfuscated using multiple encryption methods and a fixed marker variable. The malware queries a specific Solana wallet for instructions, bypassing traditional C2 domains.

When executed, the payload performs DNS lookups to Solana RPC endpoints, fetches a payload URL from the blockchain, downloads Node.js, and executes an encrypted JavaScript payload. The final payload is likely a credential stealer targeting browser extensions, cookies, and SSH keys.

On-chain analysis indicates activity from the Solana wallet associated with ForceMemo since November 27, 2025, with several transactions and rotating payload server IPs.

To mitigate risks, security teams should verify that the default branch matches the last known good commit, monitor for unexplained author-committer date gaps, and look for lzcdrtfxyqiplpd in GitHub code searches. Implementing egress-monitoring solutions is also recommended to detect anomalous network activity.

Based on reporting by GBHackers.