Water Curse Hacker Group Uses 76 GitHub Accounts to Spread Multistage Malware
## Water Curse Campaign Uses GitHub for Malware Distribution
Water Curse Campaign Uses GitHub for Malware Distribution
A newly identified threat group, Water Curse, has been linked to a campaign utilizing 76 GitHub accounts to distribute repositories containing multistage malware. This campaign, financially driven, targets cybersecurity professionals, red teamers, penetration testers, game developers, and DevOps personnel by exploiting the trust in open-source platforms.
The Water Curse campaign, first detected in May 2025 with traces back to March 2023, employs a complex infection chain. It begins with downloading compromised open-source project files via GitHub’s repository archiving service. Tools masquerading as penetration testing utilities conceal malicious code within Visual Studio project configurations.
Upon execution, these payloads trigger scripts in Visual Basic Script (VBS) and PowerShell, initiating a multistage attack. The malware downloads encrypted archives, extracts Electron-based applications, and conducts system reconnaissance while employing anti-debugging measures, privilege escalation, and persistence mechanisms.
Water Curse demonstrates technical prowess by using diverse programming languages and tools, including PowerShell, JavaScript, and C#. Their tactics involve disabling Windows Defender, deleting shadow copies to impair system recovery, and using services like Telegram and Gofile for command-and-control communication.
The Water Curse campaign, first detected in May 2025 with traces back to March 2023, employs a complex infection chain.
The group’s repositories include not only cybersecurity tools but also game cheats, crypto wallet utilities, and credential stealers. This reflects a hybrid strategy of supply chain compromise and opportunistic exploitation, suggesting a loosely organized or service-driven cybercrime model.
The campaign highlights the trend of developer-oriented information stealers. Organizations are advised to audit open-source tools rigorously, validate build scripts, and scrutinize repository histories before integration. Solutions like Trend Micro’s Vision One and Managed Detection and Response services offer critical threat detection and analysis capabilities.
As Water Curse exploits trust in platforms like GitHub, enhanced security awareness and verification practices among developers and security teams are essential to mitigate risks from such advanced supply chain attacks.
Based on reporting by GBHackers.