Hello, fellow squirrels! Today, I’m going to crack open the nutshell on GitHub WebRAT Malware campaign.
What Is WebRAT and Why Is GitHub Involved?
WebRAT is a type of malware known as a Remote Access Trojan, or RAT. This malware was discovered being distributed through fake GitHub repositories. For those who do not know what GitHub is, it is one of the biggest platforms for sharing and storing your software acorns. It is trusted by developers, students, researchers, companies, and code squirrels. The chipmunk attacker behind this made fake GitHub repositories that claimed to contain proof-of-concept exploits for security vulnerabilities. These repositories were used to spread the WebRAT malware.
What can WebRAT do?
Once WebRAT gets onto a squirrel’s computer, it mainly collects information, but it also gives attackers access to other things. It can steal credentials from platforms like Steam, Discord, and Telegram, and there could be other affected platforms that have not been identified at this point in time. It can also take information from a victim’s cryptocurrency wallet. In addition, it can collect information stored in web browsers and browser extensions on the victim’s infected computer. The last information-collection activity WebRAT performs is taking screenshots of the victim’s computer. WebRAT does two other things besides collecting information: it can give the attacker access to the infected computer’s webcam, and it can provide the attacker with remote access to the victim’s computer system.
Timeline!
Starting in September 2025, the WebRAT campaign is believed to have started.
From September to December 2025, the attackers created and maintained at least 15 malicious repositories that we know of. During this time, people downloaded these repositories thinking they contained legitimate code and unknowingly became victims of WebRAT.
In December 2025, researchers at Kaspersky identified and publicly reported the campaign. Shortly after the report, GitHub removed the repositories that were being used to spread WebRAT malware.
That’s all for today’s cyber-stuffed nutshell! So, remember in this digital forest, we the squirrels need to stay alert and protect our stash, while chipmunks try to sneak in and swipe it when we are not looking.
Here some article if you want to know more!
https://privacysavvy.com/news/cybersecurity/fake-github-exploits-webrat-malware
Leave a Reply