Github comments used to push malware via Microsoft repo urls

[remixedcat]

Just read this and it's very scary...

GitHub comments abused to push malware via Microsoft repo URLs

A GitHub flaw, or possibly a design decision, is being abused by threat actors to distribute malware using URLs associated with a Microsoft repository, making the files appear trustworthy.

www.bleepingcomputer.com

Seems like github refuses to do anything to mitigate the issue either... it's been like this for months.

 

[DudeBeFishing]

I know how to fix this, everyone mass upload files to every public repo. Maybe Microsoft will notice when Github needs 10000x more storage.

 

[kacperoo29]

Seems like a non-issue. The files don't get uploaded to source tree. It gets uploaded as an attachment just like log files would be. Wouldn't be surprised if nothing is done about it more than an option to report attachments as a malware.

 

[Carillon]

Seems like a non-issue. The files don't get uploaded to source tree. It gets uploaded as an attachment just like log files would be. Wouldn't be surprised if nothing is done about it more than an option to report attachments as a malware.

Problem is that those files are attached to nothing, only way to find them is if somebody is trying to screw you by sending a link. And the link looks legit