Long, strange, but working

Long, weird, but it works
🍊🍊🍊🍊🍊🍊🍊🍊🍊🍊🍊

Not everything we investigate turns out to be complex attacks by serious groups. Sometimes attacks only appear complex. We cover one such case in our blog.

During the analysis, a series of attacks was discovered in which attackers stored intermediate scripts and exfiltrated victim data directly in public GitHub repositories. Activity was recorded from September 2024 to April 2025. These attacks stand out due to their structure: long chains of simple scripts, apparently created using AI, judging by the code style and comments.

Despite their apparent simplicity, they effectively collected victim data, including system information, screenshots, and Telegram files, and then sent them to GitHub repositories. The attackers used legitimate PDF files as bait and masked their actions by running scripts in hidden mode.

You can see the AI comments in the code in our blog on Habr 🫲

#TI #malware
@ptescalator