AI
How MUT-1244 Built an Exfiltration Pipeline from a Fake npm Package
In December 2024, a Checkmarx post flagged a malicious npm package, ox-engine-xml-rpc, mirroring the legitimate xml-rpc package. The extra validator.js file contained obfuscated code that, when deobfuscated, zipped system files and uploaded them to a hardcoded Dropbox account using hardcoded credentials. The Dropbox scope allowed both upload and read access. Querying account metadata revealed the owner: Paul Müller 977. Inside the Dropbox, zip files each contained si.json with system info and targets.txt with nearly 400,000 credentials, each with a URL, username, and password.
The Phishing Campaign Targeting arXiv Researchers
The same Codeberg account held a spam folder with emails.db, thousands of addresses scraped from arXiv. The phishing lure told researchers they needed to update their CPU microcode. The link led to opencompile.org/micropatch, a page styled as a Linux kernel changelog. Following the suggested command fetched a script from GitHub that dropped two second-stage payloads: a coin miner and a bash info stealer. The stealer pulled the AWS and Azure credential folders, bash history, and SSH keys, then sent everything to file.io.
Trojaning a Credential Checker for Offensive Actors
Pivoting from the malware artifacts led to a Bitbucket repository for a tool called YOP, billed as a WordPress credential validator. It used two methods: HTTP login and the WordPress XML-RPC API. That second method linked directly to the typosquatted npm package name. The tool’s readme showed example runs against a file named targets.txt, the same file the malware expected to find. Its package.json listed the malicious xml-rpc package as a dependency. The attack chain: an offensive actor runs YOP against a stolen credential dump; the info stealer fires through the dependency; data exfiltrates to MUT-1244’s Dropbox.
Fake Proof-of-Concept Repositories and the Inauthentic GitHub Network
MUT-1244 created fake proof-of-concept repositories for real CVEs, targeting security researchers. Profiles used AI-generated avatars and contributed to a single repository. Readmes linked to legitimate vulnerability disclosures and claimed novel, unused attack vectors to attract offensive actors under time pressure. Feedley indexed at least one malicious PoC as a reference exploit, pushing it into vulnerability dashboards used by security teams. MUT-1244 also ran an SEO-boosted website with stolen vulnerability write-ups and an X account posting links to the fake PoCs. A graph of GitHub interactions revealed clusters of inauthentic accounts cross-promoting each other.
The Threat Actor Exfiltrated Their Own Data
MUT-1244 accidentally exfiltrated their own data to a publicly accessible location. A French pentester named Valentstein discovered and published it. The leaked bash history ran to more than 2,000 lines and included C2 authentication attempts, typo-ridden app-install commands, and RDP login attempts with stolen credentials. Git remote commands embedded in the history revealed additional GitHub usernames, including one spelled with a zero in place of an “o.” That account had commented on Stable Diffusion WebUI Forge issues. One reply included a screenshot of Total Commander in Russian, consistent with earlier Russian-language forum posts.
GH Buster: Detecting Inauthentic GitHub Activity
Tafani-Dereeper and Muir released GH Buster, an open source tool, at the time of the talk. It analyzes GitHub user and repository metadata without reading source code. Heuristics check for forks whose parent repositories were deleted, commits from emails not tied to the account’s GitHub identity, and profile fields left blank. A third mode scans everyone who starred a given repository. In the demo, a suspicious repo showed all its starers had joined GitHub on the same day, April 26, a signal of coordinated fake promotion.
Notable Quotes
and might also lure researchers to it. Matt Muir · ▶ 18:27
benign users said their full name versus Christophe Tafani-Dereeper · ▶ 30:09
concepts are great targets. Why? Because Christophe Tafani-Dereeper · ▶ 34:36
Key Takeaways
- MUT-1244 targeted academics, pentesters, and red teamers using three simultaneous initial access vectors over 2024-2025.
- Fake CVE proof-of-concept repositories reached Feedley dashboards, lending credibility and expanding the victim pool.
- GH Buster’s metadata heuristics flag inauthentic GitHub profiles and repos without reading repository source code.
About the Speaker(s)
Christophe Tafani-Dereeper lives in Switzerland and works on cloud security research and open source at Datadog. He previously worked as a software developer, penetration tester, and cloud security engineer. He maintains several open-source projects including Stratus Red Team, GuardDog, CloudFlair, and the Managed Kubernetes Auditing Toolkit.
Matt Muir is a security researcher with a focus on UNIX and UNIX-like operating systems. He previously worked as a macOS malware analyst with a background in digital forensics, DevOps, and operational cyber security. His published research includes the discovery of the first malware family to target AWS Lambda, emerging cloud-focused botnets, and novel Linux malware campaigns.