GitHub

GitHub, a prominent code-hosting platform, experienced manipulation of its pages through the use of 'ghost' accounts, as uncovered by Check Point researchers. The cybercriminal known as 'Stargazer Goblin' managed a network of approximately 3,000 fake accounts to promote malware and phishing links by artificially boosting the popularity of malicious repositories. This deceptive action not only jeopardized the integrity of GitHub's community tools but also posed risks to users by distributing malware and info-stealers, like the Atlantida Stealer, under the guise of legitimate software offerings. The platform's extensive user base heightened the potential damage, leading to GitHub's intervention to disable accounts that breach its Acceptable Use Policies.

Source: https://www.wired.com/story/github-malware-spreading-network-stargazer-goblin/

TPRM report: https://scoringcyber.rankiteo.com/company/github

"id": "git000072524",
"linkid": "github",
"type": "Cyber Attack",
"date": "7/2024",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'Software Development',
                        'name': 'GitHub',
                        'type': 'Company'}],
 'attack_vector': 'Fake Accounts, Repository Manipulation',
 'description': 'GitHub, a prominent code-hosting platform, experienced '
                "manipulation of its pages through the use of 'ghost' "
                'accounts, as uncovered by Check Point researchers. The '
                "cybercriminal known as 'Stargazer Goblin' managed a network "
                'of approximately 3,000 fake accounts to promote malware and '
                'phishing links by artificially boosting the popularity of '
                'malicious repositories. This deceptive action not only '
                "jeopardized the integrity of GitHub's community tools but "
                'also posed risks to users by distributing malware and '
                'info-stealers, like the Atlantida Stealer, under the guise of '
                "legitimate software offerings. The platform's extensive user "
                "base heightened the potential damage, leading to GitHub's "
                'intervention to disable accounts that breach its Acceptable '
                'Use Policies.',
 'impact': {'brand_reputation_impact': 'High'},
 'initial_access_broker': {'entry_point': 'Fake Accounts'},
 'motivation': 'Malware Distribution, Phishing',
 'references': [{'source': 'Check Point Research'}],
 'response': {'containment_measures': 'Disable fake accounts'},
 'threat_actor': 'Stargazer Goblin',
 'title': "GitHub 'Ghost' Accounts Manipulation",
 'type': 'Malware Distribution, Phishing'}