Everything's Coming Up RAT
Remote Access Trojans are the family of malware I see most often in my research. Sure there are infostealers and denial-of-service bots galore out there, but it always seems to come back to the ‘basics’, the one that slips by unseen by user and security software alike, leaving behind backdoors and persistent traffic feeding data to the control-and-command actor. And more and more often, they’re hiding in GitHub repositories.
The first of the two reports on the topic in my news feed today is an overall study of how GitHub and GitLab are being exploited. Cofense took a look at data spanning from 2021 to 2025, and found a significant rise in abuse among open source repositories and/or cloud native services. Fully 45% of attack campaigns happened in 2025 alone, nearly equaling the amount collected in the previous four years. Within those attacks, most of them were targeting GitHub, with just 5% aimed at GitLab (which tracks for me as a researcher; I hardly ever hear about GitLab campaigns). 58% delivered credential phishing, while 42% contain malware. Sometimes those overlap and do both. The malware seen is almost invariably some form of RAT.
The second comes from Aikido, and is a more specific breakdown of an ongoing campaign using GlassWorm. I’ve covered the Shai-Halud offshoot before (here and here), and it is still using the same tactic now, where it infects OpenVSX extensions to propagate itself. The current iteration of the malware is impersonating WakaTime, the popular developer time-tracking tool, and ships a Zig-compiled native binary alongside its JavaScript code, inserting a persistent dropper (one of its hallmarks) into the extension. From there, it infects every Integrated Development Environment (IDE), the software that works to provide users with consistent experiences as they use disparate tools. This campaign is affecting both Windows and macOS.
So why the uptick, and why RAT’s? The answer to both has to do with business done at machine speed, exploited trust, and the way RAT’s work in the first place. Code repositories store all the related files and documents involved in developing new software, and Git is a version control system (VCS), meaning that developers who need a specific branch of code can find it easily and make changes to it without losing any of the work done by others. It’s a way to share files by making each one instanced to the user (this being a code mechanic in gaming that allows multiple assets to be available in the same place regardless of how many people are utilizing them). In short, it makes a fully malleable copy or version. Inserting a Trojan into the files is not hard, given that most repositories are open source, or otherwise have low authorization requirements in order for them to be available to so many. And all it takes is one compromised file or line of code buried beneath layers of legitimate programming to infect whole development trees. Social engineering – abusing the users’ trust in the sites – does the rest.
Trojans, by nature of their intrinsic obfuscation within legitimate programs, can be difficult to remediate. Upon download they often rename themselves as something else, delete the data from the download folder so the user can’t find it, or are so embedded within whatever they rode in on that one cannot simply uninstall to take care of the problem. During my training, I had at least two assignments that involved locating the presence of a RAT, hunting through individual logs to find those run-rename-delete commands. It’s time consuming. It is generally easier to just release a new, clean version of compromised software than try to root out the initial infection. Reports such as Cofense and Aikido’s are most often warnings to be aware of infected packages and programs, usually with version numbers – both compromised and clean – so that users can check if they’re running an affected one. And it’s my job as your friendly neighborhood WISP to ensure that they don’t get buried under other news.
Posted, 4/9/26
