The attack starts with seemingly legitimate GitHub projects — like making Telegram bots for managing bitcoin wallets or tools for computer games.

Malicious actors are making hundreds of fake projects on GitHub aiming to snare private info through crypto and credential-stealing malware, says Kaspersky.

Cybercriminals are using a sneaky new method to trick developers into downloading dangerous malware. A recent campaign called GitVenom is spreading harmful software through fake GitHub repositories. These attackers create fake open-source projects that look real but secretly contain hidden threats.

Cybercriminals are exploiting GitHub to spread credential-stealing malware through fake repositories, cybersecurity firm Kaspersky has warned. The campaign, dubbed “GitVenom,” involves attackers creating seemingly legitimate projects filled with malicious code that infects users’ devices upon download.