Loading story…
A malicious installation link was discovered embedded in the GitHub Wiki documentation for Mockito, a widely used Java mocking framework. The link, which pointed to a third-party URL (https://yip[.]su/2F5rd4), was flagged as malicious by VirusTotal and was unrelated to the official Mockito project. The compromised link was present in the Wiki’s installation section for over three years before its removal, raising concerns about the potential exposure of users to malware during that period. The injected HTML rendered download buttons, specifically including a Windows installer link that redirected to the malicious URL, while the Mac and Linux links pointed to legitimate Mockito release pages. The malicious link was inserted in a way that made it appear as an official download option, increasing the likelihood that unsuspecting users would click it. Evidence of the compromise is visible in the Wiki’s revision history, which shows the addition and subsequent removal of the malicious content. The issue was discussed in the project's GitHub issue tracker, where maintainers and users highlighted the risks and the need for better controls over documentation edits. The malicious link was not only present in the HTML but also disguised as a download button, further obfuscating its true nature. VirusTotal analysis confirmed the link’s malicious status, indicating it could have been used to distribute malware or conduct phishing attacks. The incident underscores the risks associated with open documentation platforms like GitHub Wikis, where insufficient access controls can allow attackers to inject harmful content. Security experts recommend that project maintainers lock down their Wikis and restrict editing permissions to trusted contributors. The long duration of the compromise suggests that many users may have been exposed, though the exact number of affected downloads is unknown. The incident has prompted calls for more rigorous monitoring and auditing of open source project documentation. This case highlights the importance of verifying download links and the potential for supply chain attacks via documentation tampering. Project maintainers are urged to regularly review and audit their documentation for unauthorized changes. The broader open source community is advised to treat documentation as a potential attack vector and implement appropriate security measures.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
The Mockito documentation site was reportedly hijacked, forming the core security incident described by the references. No additional dated milestones, remediation actions, or impact details are provided in the supplied content.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported a supply-chain campaign targeting developers by impersonating legitimate AI-related tooling and luring victims into installing malware. A malicious PyPI package, `grokwrapper`, posed as an unofficial API wrapper for xAI’s Grok and used a common “benign-first, malicious-later” publishing pattern: an initial clean release was followed by a weaponized update intended to evade registry and scanner scrutiny. Once installed, the package was described as downloading and executing a second-stage payload, establishing persistence via Windows Registry changes, and maintaining access using **DLL sideloading** with a legitimate Microsoft binary (`wkspbroker.exe`), with targeting described as focused on developers outside CIS countries and consistent with tradecraft associated with **DPRK-linked** activity (including references to *Operation DreamJob* expansion beyond prior sectors). Separately, a maintainer documented abuse of a forked GitHub repository to distribute malware by converting the project’s README into a fake Windows “installer” landing page and embedding a ZIP payload directly in the source tree (rather than using GitHub Releases or a package manager). The attacker then rewired “Download” links to the embedded archive, mirrored the content via GitHub Pages, and reused the original project’s topics/metadata to drive **SEO hijacking**, increasing the chance that searches for enterprise AI integration terms would land on the malicious fork while the original author’s name appeared as a contributor due to inherited commit history. Together, the incidents highlight active abuse of trusted developer ecosystems (*PyPI* and *GitHub*) to deliver Windows malware through social engineering and dependency/asset trust assumptions.
Jul 12, 2026
GitHub has been hit by a large-scale **repo confusion** campaign in which attackers fork legitimate projects, keep names and appearances close to the originals, and inject heavily obfuscated malicious code intended to steal passwords, cryptocurrency wallets, and other developer secrets. Apiiro reported that the operation was largely automated and tied to more than **100,000 infected repositories**, while Ars Technica said the broader attack generated **millions of malicious repositories** and exploited the difficulty users face distinguishing authentic projects from poisoned forks. Multiple GitHub repositories later carried security issues warning that **malicious code had been injected via compromised accounts**, including projects such as `django-restful-admin`, `ImportNURBS`, `siriraj-assist`, `ood_coverage`, `issued`, and `bottom-up-attention-vqa`. The notices indicate the campaign was not limited to fake lookalike repos but also reached legitimate codebases through account compromise, extending the supply-chain risk to developers who clone, fork, or build from affected repositories while GitHub continues removing abusive content through reporting, manual review, and machine-learning-based detection.
Jun 29, 2026
A large-scale phishing campaign is abusing **GitHub Discussions** to post fake **Visual Studio Code** security alerts that pressure developers into downloading malware from external links. The posts impersonate legitimate advisories with fabricated `CVE` identifiers, fake affected version ranges, and urgent language, while newly created or low-activity accounts mass-tag developers across unrelated repositories to expand reach. Because GitHub Discussions can trigger email notifications to watchers and participants, the operation gains additional credibility and visibility beyond the platform itself. Analysis of the linked infrastructure showed a multi-stage redirection chain that used a Google `share.google` endpoint and the attacker-controlled domain `drnatashachinn[.]com`. The delivered JavaScript performed browser fingerprinting, cookie checks, obfuscation, and anti-analysis steps to distinguish real users from bots or security scanners before routing victims to later-stage malicious content, consistent with a traffic distribution system. Researchers said the campaign appears coordinated and automated, and urged developers to treat unsolicited GitHub security alerts with external download links as suspicious and verify VS Code updates only through official Microsoft channels.
Jun 29, 2026