Microsoft has removed some undisclosed GitHub repositories leveraged in a massive malvertising campaign that affected nearly 1 million devices worldwide. The company had this to say:
In early December 2024, Microsoft Threat Intelligence detected a large-scale malvertising campaign that impacted nearly one million devices globally in an opportunistic attack to steal information. The attack originated from illegal streaming websites embedded with malvertising redirectors, leading to an intermediary website where the user was then redirected to GitHub and two other platforms. The campaign impacted a wide range of organizations and industries, including both consumer and enterprise devices, highlighting the indiscriminate nature of the attack.
GitHub was the primary platform used in the delivery of the initial access payloads and is referenced throughout this blog post; however, Microsoft Threat Intelligence also observed one payload hosted on Discord and another hosted on Dropbox.
The GitHub repositories, which were taken down, stored malware used to deploy additional malicious files and scripts. Once the initial malware from GitHub gained a foothold on the device, the additional files deployed had a modular and multi-stage approach to payload delivery, execution, and persistence. The files were used to collect system information and to set up further malware and scripts to exfiltrate documents and data from the compromised host. This activity is tracked under the umbrella name Storm-0408 that we use to track numerous threat actors associated with remote access or information-stealing malware and who use phishing, search engine optimization (SEO), or malvertising campaigns to distribute malicious payloads.
I have a number of comments on this. Starting with Ensar Seker, CSO at SOCRadar:
“The attackers used geofencing, device fingerprinting, and cloaking techniques to evade detection, which means the malicious payload is only delivered to targeted users, making it harder for security solutions to track and mitigate the campaign.
This campaign is likely part of a broader MaaS (Malware as a Service) ecosystem, where attackers use pre-built malvertising kits to distribute payloads like stealers, ransomware, and banking trojans. Malvertising has traditionally targeted Windows users, but with more professionals using macOS and Linux, we’ll see cross-platform payloads becoming more common.”
Roger Grimes, data-driven defense evangelist at KnowBe4 follows with this:
“It’s important to remember that despite the ingenuity and complexity of this malware dropper campaign, the victims still had to be socially engineered into executing the content on their system for their system to be compromised. They didn’t just see a (malicious) advertisement, click on it, and get compromised. No, they had been socially engineered into not only clicking on the ad, but then into approving the resultant prompts that then ran the malicious content (as long as they were fully patched). Seventy to ninety percent (70% – 90%) of all successful data breaches involve social engineering. A common type of social engineering is malicious advertising. Make sure your users are aware of how not every ad or internet search will lead them to a good place. In fact, these ads and Internet search returns often lead people to bad places. It’s something they need to be aware of.”
It’s good that Microsoft has taken action to take these repositories down. Hopefully they can maintain their vigilance to make sure that this doesn’t become a common occurrence.
At least 36 US schools involved in data breach following ransomware attack
Posted in Commentary with tags Hacked on March 7, 2025 by itnerdThe ransomware gang known as Skira yesterday claimed responsibility for a December 2024 data breach at Carruth Compliance Consulting, a company which administers retirement savings plans.
Comparitech reported that this breach led to at least three dozen school districts and colleges across the US–Carruth’s clients–reporting data breaches that compromised the personal data of more than 110,000 school employees.
Rebecca Moody, Head of Data Research at Comparitech commented:
“Attacks like this highlight how far-reaching the impact of these data breaches via ransomware can be. A breach on one provider can affect multiple educational institutions, as we saw only too well with Blackbaud in 2020. Schools and colleges may have the best cybersecurity measures in place, but they’re only as good as the third parties they use.”
“It remains to be seen just how many schools have been affected by this attack, but we’ve found over 30 that have reported breaches so far. And with sensitive data involved, such as Social Security Numbers, schools need to act fast to ensure those affected are aware as soon as possible. We’d highly recommend people take up the offer of free credit monitoring and that they also remain vigilant for any phishing emails, calls, or text, and suspicious activities on their accounts.”
Paul Bischoff, Consumer Privacy Advocate at Comparitech adds:
“Ransomware attacks on US finance companies can lock down computer systems and steal data. Companies must then either pay a ransom or face extended downtime, data loss, and putting data subjects at increased risk of fraud. Ransomware can disrupt a wide range of operations including communication, financial transactions, access to stored files, and more.”
“Comparitech researchers logged 58 confirmed ransomware attacks on US finance companies in 2024, compromising 34.6 million records. The average ransom for a finance company is $1 million.”
“In addition to confirmed attacks, Comparitech tracked 151 unconfirmed claims against US finance companies in 2024, and 43 so far in 2025. These are claims made by ransomware groups but not acknowledged by the targeted organizations.”
While this isn’t the worst attack that I have seen, I would not be shocked if this does get worse. Because these sorts of attacks have a habit of starting out being not that bad. Then they get worse as more facts come to light. So be sure to bookmark this for updates as they become available.
Leave a comment »