Water Curse Employs 76 GitHub Accounts to Deliver Multi-Stage Malware Campaign
Water Curse is a hitherto unidentified threat actor that uses weaponized GitHub repositories to spread multi-stage malware, according to cybersecurity analysts.
According to an investigation released this week by Trend Micro researchers Jovit Samaniego, Aira Marcelo, Mohamed Fahmy, and Gabriel Nicoleta, the virus permits remote access, long-term persistence on compromised devices, and data exfiltration (including credentials, browser data, and session tokens).
First discovered last month, the extensive and persistent campaign installed repositories that appeared to be harmless penetration testing tools but actually contained malicious payloads including Sakura-RAT and SMTP email bomber in their Visual Studio project configuration files.
A variety of technologies and programming l...