Loading story…
Attackers compromised the GitHub account of the Deep-Live-Cam maintainer, reportedly despite two-factor authentication, and modified the face-swapping project's requirements.txt to replace the legitimate requests dependency with the attacker-controlled pypls/requests repository. The malicious dependency used obfuscated build-time code in setup.py to retrieve a multistage Python payload during pip/setuptools installation; the malicious revision was present on the main branch for about 9 hours and 39 minutes before it was reverted.
The payload targeted Windows and macOS, established per-user startup persistence, and monitored the clipboard for supported cryptocurrency wallet addresses, replacing them with attacker-controlled addresses to redirect payments. Deep-Live-Cam has roughly 96,600 GitHub stars, increasing potential downstream exposure, though available evidence confirms the malware's execution path and capabilities—not the number of infected users, successful thefts, financial losses, or attacker attribution.
Trace attribution and downstream blast radius.
7 events from the most recent confirmed update back to the earliest known activity.
SafeDep published an analysis documenting the malicious dependency, staged Windows/macOS payload delivery, clipboard-hijacking behavior, persistence mechanisms, and related infrastructure. The analysis noted that available evidence did not establish infection volume, attacker attribution, theft, or financial losses.
Deep-Live-Cam reverted the malicious dependency change with commit 55d306d5ae07a4e6494013422ab244306a5c0879 at 01:37:35 UTC. The malicious revision had remained on the main branch for approximately 9 hours and 39 minutes.
GitHub user fred-cardoso opened Deep-Live-Cam issue #1930 identifying the malicious dependency at 01:26:18 UTC.
Installing the altered dependency caused an obfuscated setup.py to execute during pip/setuptools source builds, retrieve further code for Windows and macOS, establish startup persistence, and monitor the clipboard for cryptocurrency addresses to replace with attacker-controlled addresses.
A commit pushed under the hacksider account modified Deep-Live-Cam's requirements.txt, rewriting 18 dependency entries and adding requests from the attacker-controlled pypls/requests Git repository. The commit was pushed at 15:58:54 UTC.
The GitHub account pypls and its repository impersonating the Requests package were created. The repository declared its package name as requests while retaining metadata linked to the legitimate project.
The Deep-Live-Cam maintainer reported unusual account access despite two-factor authentication and changed passwords and keys following the incident. Available unsigned commit metadata did not establish whether a token, SSH key, or authenticated session had been compromised.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcesafedep.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malware campaign has been distributing Rust-based cryptocurrency clipboard hijackers for **Windows** and **macOS** by masquerading as crypto trading bots, Solana and Pump.fun sniper bots, Aviator Predictor, and other crash-game predictor tools. Researchers said the operation used a WordPress phishing site as a central hub and boosted credibility through coordinated promotion on **GitHub**, **SourceForge**, **YouTube**, crypto forums, and even posts placed on legitimate news websites, targeting crypto holders, traders, and gamblers seeking quick profits or unfair advantages. On Windows, a **.NET** loader deployed a Rust clipper that stored files under `%APPDATA%`, created Startup shortcut persistence, and swapped copied wallet addresses with attacker-controlled ones from an embedded list of more than **15,500** addresses. On macOS, victims were guided through a loader and an "unlocker" script to bypass **Gatekeeper**, after which a Rust clipper installed **LaunchAgent** persistence and a self-healing watchdog. The activity was linked across platforms through the Telegram handle and WordPress author name `@JoseCmanXD`, while the operators also manipulated **VirusTotal** community sentiment with benign votes and "safe" comments; attacker-controlled wallets reportedly received multiple transactions, indicating successful theft.
Aug 11, 2026
Researchers reported active **software supply chain attacks** in which legitimate GitHub accounts and repositories were compromised and then used to distribute malware to developers. In one case, the verified **dev-protocol** GitHub organization was hijacked and repurposed to host polished **Polymarket** trading-bot repositories that secretly pulled typosquatted npm dependencies. Running the project exfiltrated `.env` contents including wallet private keys to attacker-controlled infrastructure, performed host fingerprinting, and modified firewall settings to expose SSH access; victims were advised to rotate wallet and API secrets and inspect `~/.ssh/authorized_keys` for persistence. A separate but related GitHub-focused campaign, dubbed **ForceMemo**, involved takeover of developer accounts and force-pushes to hundreds of Python repositories so that malicious code was appended to files such as `setup.py`, `main.py`, and `app.py` while preserving original commit metadata. Anyone installing directly from those repos could trigger the payload, and the activity affected projects ranging from Django applications to ML and Streamlit code. A report on malicious npm packages posing as a Roblox *Solara* executor was excluded because it describes a different npm ecosystem campaign centered on **Cipher stealer**, not the GitHub account and repository hijacks used in the other incidents.
Jun 29, 2026
Researchers reported a large-scale GitHub malware distribution campaign that has operated since March 2025, using repositories masquerading as cracked browser extensions, gaming cheats, developer tools, and, more recently, fake AI skills and MCP servers. The activity has been tied to a Vietnamese-speaking operator and spans more than 47 GitHub accounts and 600 malicious ZIP archives, with some accounts believed to have been compromised rather than created solely for abuse. The campaign’s social-engineering lures target both general users and developers seeking unofficial software, automation tools, or AI-related components. The repositories deliver a multi-stage **LuaJIT** loader chain that ultimately installs the **StealC** information stealer. Payloads are fetched from GitHub “dead drop” repositories, then decrypted through layered obfuscation including hex, XOR, `base64url`, and **AES-ECB** before process hollowing is used for injection. Researchers said the malware also resolves command-and-control infrastructure through **Polygon Mainnet** smart contracts, allowing operators to rotate C2 URLs or IPs without changing deployed binaries; telemetry linked the activity to detections such as BitDefender `Gen:Heur.FakeGit.1` and ESET’s `Lua/Agent` family, while infrastructure usage heavily overlapped with bulletproof hosting providers including **ASN 207957 (Serv.host Group Ltd)**.
Jul 22, 2026