SlowMist phát hiện kho lưu trữ GitHub giả mạo Qwen được sử dụng để phân phối phần mềm độc hại

The Huoxing Finance report states that the SlowMist Security Team recently disclosed a malicious GitHub repository impersonating the "Qwen 3.8 27B Local Quantized Model." The repository claimed the model files should exceed 16GB, but the actual downloaded content was only about 487KB, containing disguised files, a LuaJIT interpreter, and obfuscated Lua scripts. SlowMist emphasized that the official Qwen project has not been compromised. SlowMist's analysis revealed that after execution, this malicious program collects host information, takes screenshots, and sends them to the attacker’s C2 server; when the hardcoded server becomes unavailable, it also reads backup C2 addresses from a contract on the Polygon chain, allowing attackers to rotate infrastructure via on-chain transactions. Subsequent payloads can steal browser login credentials, cookies, browsing history, email accounts, WinSCP and Steam credentials, as well as files and extension data related to cryptocurrency wallets. SlowMist also found that at least 23 GitHub repositories and 29 similar compressed packages used the same Lua delivery chain.