Malware in the Wild as Malicious Fork of Legitimate Triton App Surfaces on GitHub

A malicious version of the legitimate macOS application Triton has been identified on GitHub, using open-source repositories to distribute malware.

This fraudulent repository, created under the account "JaoAureliano," appears as a copy of the original Triton app developed by Otávio C. However, it redirects users to download a ZIP file containing Windows-based malware.

The attack vector involves embedding malicious download links throughout the repository's README file, directing users to download a file named Software_3.1.zip, which is positioned within an Xcode colorset directory.

Users downloading this 1.33 MB archive receive executables intended to compromise Windows systems, although Triton is exclusively a macOS application.

Security researcher Brennan identified the malicious repository following discussions on an IRC server about suspicious forking activities.

Analysis via VirusTotal revealed a detection rate of 12 out of 66 vendors for the malware sample, with a file hash of 39b29c38c03868854fb972e7b18f22c2c76520cfb6edf46ba5a5618f74943eac.

The GitHub account raised several concerns, including a sparse commit history with only two repositories, while the contribution graph was artificially manipulated with automated scripts to backdate dummy commits.

Repository topics included unusual tags such as "malware," "deobfuscation," and "symbolic-execution," possibly attempting to present itself as educational security content.

Despite multiple reports, GitHub had not removed the malicious account at the time of discovery. This incident is part of a larger trend where GitHub is exploited for malware distribution, with similar campaigns ongoing .

Infection Mechanism and Evasion Tactics

The malware utilizes a multi-stage execution chain, starting with archive extraction using 7za.exe with the password "infected."

The payload employs LuaJIT for scripting and incorporates evasion techniques, including debug environment detection, extended sleep timers to bypass sandboxes, and virtualization detection.

Network communications establish command-and-control channels disguised as Microsoft Office traffic, utilizing domains such as nexusrules.officeapps.live.com and svc.ha-teams.office.com, while conducting IP discovery via ip-api.com and blockchain communications to polygon-rpc.com.

The malware performs system reconnaissance by checking for development environments like Java, Python, and .NET installations, alongside security software logs.

Registry keys are accessed to gather configuration data and establish persistence, with file operations targeting system directories for privilege escalation.

Organizations are advised to verify repository authenticity before downloading files from GitHub forks . Security teams should monitor for the file hash and network indicators, while implementing endpoint detection solutions.

Based on reporting by Cyber Security News.