I got targeted: Trying to get your credentials via a git post-checkout hook
A fake client shared a Dropbox git repo whose post-checkout hook fetched and executed a remote binary.
Frank Wiles of REVSYS received a routine-looking EdTech project inquiry and a Dropbox folder, then was told to switch to an NDA git branch before a call. The repo's post-checkout hook used a Vercel app as command and control to download an OS-specific binary, mark it executable, run it, and delete it. He did not execute the hook, alerted Dropbox and Vercel, and said the operators were impersonating a development-shop owner in an apparent attempt to reach GitHub and client credentials.
- Fake EdTech client used a Dropbox folder and an NDA branch as the lure.
- The post-checkout hook downloaded, executed, then deleted an OS-specific binary.
- Command and control was a Vercel app contacted by the hook.
- Wiles did not run the hook and reported the Dropbox and Vercel accounts.
- Attackers impersonated a development-shop owner while seeking GitHub and client access.
- ATT&CK
- T1566.002 Spearphishing LinkT1204.002 Malicious FileT1105 Ingress Tool TransferT1071.001 Web ProtocolsT1070.004 File Deletion
- Products
- Git
- Victims
- Frank WilesREVSYS
From the original article
2 min read at frankwiles.com
TL;DR Someone targeted me in an attempt to run arbitrary code on my laptop. I suspect in an attempt to gain access to my Github account and/or other Be careful out there folks. They’re coming and they’re fucking sneaky!
By frankwiles.com by frankwiles · frankwiles.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.