Threat actors abuse GitHub service to host a variety of phishing kits

Editor’s Note:

As of Friday, April 19, GitHub had taken down all accounts hosting phishing material listed in this blog. GitHub has been extremely responsive in addressing this abuse of their systems.

Overview

As Proofpoint researchers have observed in the past, phishers and other threat actors are able to bypass whitelists and network defenses due to their widespread use of large consumer cloud storage sites, social networking, and commerce services such as Dropbox, Google Drive, Paypal, Ebay, and Facebook.

Since at least mid-2017, phishers have also been abusing free code repositories on the popular GitHub service to host phishing websites on the canonical  $github_username.github.io domain.

(More information on hosting web pages on the GitHub service can be found on https://pages.github.com/)

These repositories have been used for a range of malicious activities, including the phishing email campaign shown in Figure 1 abusing a retail bank brand:

Figure 1: Email lure abusing a retail bank brand leading to a phishing kit hosted on GitHub

The actual phishing landing page corresponding to this email campaign appears below (Figure 2):

Figure 2: Phishing landing page using stolen brand graphics from a retail bank  to steal credentials from users who are redirected to it via a URL in a malicious email message

Analysis

In most cases of GitHub abuse described here, threat actors establish a  canonical code repository site within the github.io canonical domain that resembles the brand they are abusing. For example, the domain associated with the bank phishing site in Figure 1 was app-l0gin-<bankname> [.] github [.] io

Inspecting the lookalike GitHub account itself using the web user interface, we can then pivot to the settings:

Figure 3: Account view of the phishing kit installed at app-l0gin-<bankname> [.] github [.] io

The files in the phishing kit are viewable as follows:

Figure 4: Landing page source code of app-l0gin-<bankname> [.] github [.] io

Upon inspection, the HTML code is lightly encoded in order to obfuscate its usage:

Figure 5: Obfuscated source code in app-l0gin-<bankname> [.] github [.] io

When the obfuscation is removed, we can see that the credentials are sent in HTTP POST to another website.

Figure 6: Deobfuscated source code in app-l0gin-<bankname> [.] github [.] io

Sending stolen credentials to another compromised website  appears to be commonplace for all the active phishing kits we have observed on github.io. Moreover, it appears that the kits do not use typical hosted PHP methods because the github.io platform does not provide PHP back-end services.

Some actors are simply using the github.io domain as a traffic redirector, which typically enables  the actual phishing page to live a bit longer before being taken down (Figure X).

Figure 7: Example of HTTP redirect in a public GitHub account

In contrast to private paid accounts, due to the nature of public GitHub accounts, we were able to observe when actors made changes to their hosted web pages. This visibility may help give insight to the nature of edits performed on phishing kits that were not written from scratch. As most kits are not written from scratch and are instead simply modified by different actors to suit their individual purposes, this level of visibility may be useful for defenders tracking actor behavior and attribution.

Figure 8: Tracking changes in the HTML source of a public GitHub account

Based on changes in the HTML code, we were able to observe updates to indicators of compromise including shortened links:

Figure 9: Add/Deletes in the source code of a public GitHub account

The actor also modified the phishing landing page to use a PHP script hosted on a remote domain rather one local to the kit.

Figure 10: Change to a public GitHub landing page to reflect PHP script loaded from remote domain

GitHub includes an interface to show which accounts are updating files in a repository. In reviewing some of the phishing source repositories hosted on github.com, Proofpoint identified a particular user, “greecpaid,” who has been editing multiple kits:

Figure 11: user greecpaid has made commits to multiple files in a GitHub repository.

If we inspect their profile they appear to be inactive on the GitHub service.

Figure 12: an activity view of user greecpaid on the GitHub service.

However, a simple “committer” search on GitHub shows all of the phishing kits that this user has edited recently.

Figure 13: Multiple instances of user greecpaid pushing commits to the GitHub service

Additional Examples

Although GitHub has removed all of the phishing kits we identified here, the following screenshots provide additional examples of the types of phishing and stolen branding we observed.

Figure 14: Email lure featuring stolen branding for Indeed.com

The landing page linked from this email lure appears in Figure 15 below:

Figure 15: Credential phishing landing page for Jrgen-employ [.] github [.] io

Figure 16: email lure for net-mailcn.github.io

Figure 17: Credential phishing landing page for net-mailcn.github.io

Observed abuse of GitHub to host phishing kits extended beyond campaigns targeting English-speaking victims, as the example in Figures 18 and 19 show.

Figure 18: DHL email lure for global-dhi [.] github [.] io featuring stolen DHL branding

Figure 19: DHL phishing landing page for global-dhi [.] github [.] io

Conclusion

In the past, threat actors have been able to evade detection by using well-known and trusted consumer cloud, social networking, and commerce services to host files as well as web hosts. Microsoft’s free accounts on the GitHub service, which have typically been used for Open Source and other public software development repositories, are equally vulnerable to widespread abuse. While the GitHub service itself appears to be responsive and especially vigilant in taking down abusive accounts hosting this type of material, defenders should be aware of potential malicious content on $github_username.github.io canonical domains.

 

GitHub repositories used for phishing (Inactive as of 4/19)

hxxp://github[.]com/aspenmoris/request

hxxp://github[.]com/aspenmorisuk/confidential

hxxp://github[.]com/business-onlineoutprofile/owa_do

hxxp://github[.]com/chat-we/continue

hxxp://github[.]com/document-sales/drop-paperless-file

hxxp://github[.]com/dropbox4realestate/dgg36463633gffeg3f44

hxxp://github[.]com/dropboxco/dropboks

hxxp://github[.]com/dropboxco/sdjg67rfg4674676sdfg

hxxp://github[.]com/dropboxenquiry/purchasedocs

hxxp://github[.]com/en-employer/return-indeed-accounti-dashbaord

hxxp://github[.]com/exhange-server-embedportal/upgradev3

hxxp://github[.]com/fact-sheet/paperless-dropb-v19

hxxp://github[.]com/fulldetails/housing

hxxp://github[.]com/global-dhI/china-VR5-Parcel

hxxp://github[.]com/intui-nternal/tuit.com-signin

hxxp://github[.]com/jonsnowarya/aspenmoris.com

hxxp://github[.]com/louiewarna/premium-docusign-/docusign

hxxp://github[.]com/mattbuil/joshstephens

hxxp://github[.]com/mattbuil/request

hxxp://github[.]com/mcrsoft-login/mail_owa-gb

hxxp://github[.]com/mufasa123321/dropbox

hxxp://github[.]com/mufasa123321/timothy

hxxp://github[.]com/new-connections/our-v16-time-profile

hxxp://github[.]com/onedrivefile/newfile

hxxp://github[.]com/ourtime-us-com/v3-i-login-CPSessionID-1e1141b3-b626-4ec2-8d2b-309dfa64

hxxp://github[.]com/Payment-inv/adobe.profile-document

hxxp://github[.]com/purchasedocs4realestate/cynthiamorgan

hxxp://github[.]com/Quick-invoice/abobe.authentication

hxxp://github[.]com/secure1Q-chase/dashboard1-dashboardme

hxxp://github[.]com/session2login-online

hxxp://github[.]com/sitashboard/vs02-profile-Return

hxxp://github[.]com/upgrade-telusidentit/app-authorization_oa

hxxp://github[.]com/us-doabox/manage-docx-preview

hxxp://github[.]com/V1-dashboard-online/outl00k-app

hxxp://github[.]com/wardrldaer/requests

hxxp://github[.]com/wardrldder/github

hxxp://github[.]com/webmailcn/authenticate-id

hxxp://github[.]com/node-mirc/live-account

hxxp://github[.]com/net-mailCN/continue

 

Sampling of domains active since Jan 2019

 

admin-microsoftonline-com.github[.]io

anastasia-stepanova.github[.]io

app-l0gin-reglons.github[.]io

aspenmorisukcom.github[.]io

binance-btc.github[.]io

blockrmv.github[.]io

bttpromotion.github[.]io

center-of-payments-paypal.github[.]io

dl-dropbox.github[.]io

docussgn.github[.]io

dropboxenquiry.github[.]io

ebay-cardconfiguration.github[.]io

ebay-helpscardbusiness.github[.]io

ebay-home.github[.]io

ebay-my.github[.]io

ebay-pays-sell.github[.]io

ebay-support.github[.]io

ebay-wbe.github[.]io

ebay-wbrr.github[.]io

ebaypaypal.github[.]io

ebaypayserror.github[.]io

ebaypayserror.github[.]io

ebaypayss.github[.]io

ebays-com.github[.]io

errorpaypal.github[.]io

facebooktw-login.github[.]io

gift-cards-paypal.github[.]io

housepropertyie.github[.]io

jrgen-employ.github[.]io

manazaheer.github[.]io

markin.github[.]io

messiade.github[.]io

mez0erague.github[.]io

nondatuta.github[.]io

office-outlook.github[.]io

officialmcafee.github[.]io

outdhl.github[.]io

outdhl.github[.]io

paypal-business-giftcards.github[.]io

paypal-business.github[.]io

paypal-do-home.github[.]io

paypal-egiffts.github[.]io

paypal-egift.github[.]io

paypal-egiftcard.github[.]io

paypal-egifts.github[.]io

paypal-giftcards-us.github[.]io

paypal-giftcards.github[.]io

paypal-me.github[.]io

paypal-payment.github[.]io

paypal-prepaid-gift-cards.github[.]io

paypal-serial.github[.]io

paypal-signgiftcard.github[.]io

paypalerrorpay.github[.]io

paypalgifs.github[.]io

paypalgift.github[.]io

paypalgiftcards.github[.]io

paypalgiftfts.github[.]io

paypalpay.github[.]io

paypalpayments.github[.]io

portabledocuments.github[.]io

propertyandhousing.github[.]io

purchasedocs4realestate.github[.]io

rekus.github[.]io

revolutionnew.github[.]io

richienb.github[.]io

session2login-online.github[.]io

skilltekfeed.github[.]io

updateredirect.github[.]io

upgrading-accounts.github[.]io

us-ppal.github[.]io

we-admin.github[.]io

webmailcn.github[.]io

yotolegoca.github[.]io

 

ET and ETPRO Suricata/Snort Signatures

Generic Detections for Suricata version 4 and up are in the ET OPEN ruleset

ET POLICY Request for Possible Binance Phishing Hosted on Github.io

ET POLICY Request for Possible Ebay Phishing Hosted on Github.io

ET POLICY Request for Possible Webmail Phishing Hosted on Github.io

ET POLICY Request for Possible Account Phishing Hosted on Github.io

ET POLICY Request for Possible Office Phishing Hosted on Github.io

ET POLICY Request for Possible Outlook Phishing Hosted on Github.io

ET POLICY Request for Possible DHL Phishing Hosted on Github.io

ET POLICY Request for Possible Docusign Phishing Hosted on Github.io

ET POLICY Request for Possible Adobe Phishing Hosted on Github.io

ET POLICY Request for Possible Paypal Phishing Hosted on Github.io

ET POLICY Request for Possible Microsoft Phishing Hosted on Github.io

ET POLICY Request for Possible Facebook Phishing Hosted on Github.io