A new wave of cyberattacks is targeting GitHub repositories, wiping their contents, and demanding ransom from victims. This alarming campaign, first identified on Wednesday by Germán Fernández, a security researcher at Chilean cybersecurity firm CronUp, is being orchestrated by a threat actor using the handle “Gitloker” on Telegram.
The attackers are reportedly compromising GitHub accounts using stolen credentials. Once they gain access, they delete the contents of the repositories and create a backup of the data, which they claim can restore the deleted information. The compromised repositories are then renamed, and a single README.me file is added, instructing victims to contact the attackers via Telegram for further details.
Victims receive a ransom note that reads, “I hope this message finds you well. This is an urgent notice to inform you that your data has been compromised, and we have secured a backup.” This message is intended to coerce the victims into engaging with the attackers in hopes of recovering their lost data.
GitHub has yet to release an official statement regarding the Gitloker extortion campaign. However, the platform has previously advised users to take several precautionary measures to secure their accounts. These include changing passwords, enabling two-factor authentication, adding a passkey for secure, passwordless login, and reviewing account security logs to track any changes in the repositories.
Security Recommendations
To protect against such malicious acti
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.