Researcher Identifies Thousands of GitHub Repositories Used to Distribute Trojan Malware Through Cloned Projects

An independent researcher reported uncovering a large-scale malware distribution operation on GitHub after noticing cloned versions of legitimate repositories that had recently been modified to include links to downloadable ZIP archives. These repositories copied the original project history, contributors, names, and descriptions, making them appear trustworthy. The added archives typically contained command scripts, executable files, DLLs, and additional components that allegedly delivered Trojan malware. Initially, only a small number of suspicious repositories were identified, but further investigation revealed a much larger pattern. Using data from GH Archive and the GitHub API, the researcher developed a script to search for repositories exhibiting specific characteristics, including cloned commit histories, README modifications containing ZIP links, repeated commit replacement behavior, and repositories that were not marked as forks. After refining the detection criteria, the script reportedly identified approximately 10,000 repositories matching the pattern out of around 40,000 candidates. The author believes the attackers clone newly created repositories to improve visibility in search engine results and GitHub tag listings while leveraging copied contributor histories to increase credibility. The article raises concerns about GitHub’s ability to automatically detect such campaigns and questions why similar repositories remained active for extended periods. According to later updates, GitHub removed many repositories identified by the script, although the author claims newly discovered repositories continued to appear. The article also references earlier security research and community reports describing similar malware-distribution techniques involving fake GitHub repositories and Trojan loaders.