How Discord scammers are trying to get GitHub users to install malware

Just a few days ago, I posted about the NSFW spam epidemic on Discord. The gist of it: bots promote servers that promise you NSFW content if you "verify your account" on a phishing site that imitates the Discord login page. I created a throwaway account, intentionally got it phished and gave it access to a single channel on one of my own servers to see what (if anything) the attackers would use it to post. As expected, it didn't take long for it to be used to promote the same kind of phishing scam. But today I saw that it got used to push something different, a scam that uses Discord horndogs to help with a different attack whose real target seems to be GitHub users.

I'm also posting this as a thread on Mastodon because it's a fairly short story. Leave your comments there if you have any.

Story

It begins with NSFW spam much like we already know, except that the server being promoted looks really out of place; instead of having a picture of a woman as an avatar and a name like "NSFW + CHATTING + NITRO💖🍒🍑", it doesn't have a picture and is called "stephaniedavis". I (still) genuinely have no idea why that is. Perhaps the scammers simply forgot to finish their server setup.

In any case, that server doesn't contain anything except for another server invite, which allegedly has the goods. That server, in turn, promotes four different things that all try to extract value or scam people in different ways:

• links to MEGA folders containing stolen OnlyFans content from a handful of creators, behind a URL-shortener that claims it pays people sharing its URLs
• a website allegedly aggregating stolen OnlyFans content and reselling it (presumably, the scam is a really dumb one: you pay them in crypto or via PayPal friends & family and simply never hear from them again)
• two different ways to gain "full access" to the server's content (allegedly):
  • "download and run this exe!" (which, of course, is malware)¹
    
  • "create a GitHub account and star and fork this repo!" (...wait, what?)

So, obviously what made me raise an eyebrow is that last point. Here's their pitch:

Ah yes yes, of course, makes perfect sense. A completely reasonable and unsuspicious thing to ask.

Now, what is that repo?

So, this repo (link) pretends to be the source code for a real intelligence-gathering tool. I've skimmed the code and couldn't find anything suspicious. It essentially just consists of one bigger .cs file and some resources for the included Windows forms GUI. I think it's likely that the code is ripped from another (legitimate) project, but I can't say for sure. Assuming the code is indeed completely harmless, the repo's main purpose then is to get people to download/run (one of) the exe files in the release.

And sure enough, those seem to be malware. This github issue gives us an idea of what it actually does: it apparently runs a crypto miner. Concerningly, people seem to take the "maintainer's" claims – that this malware is not real or simply a mistake – at face value given the apparent reputation of the project. Well, here's an idea for the future: consider GitHub stars meaningless.

That's it

So, I suppose there's nothing too surprising in this story at the end of the day. I've reported the repository on GitHub (you should do the same). But I found the setup for this operation pretty out of the ordinary. Genius, really: why buy GitHub bots if you have a completely disconnected, real army of people on Discord who will follow even your most ridiculous order as long as they think they get porn at the end?