The attack starts with seemingly legitimate GitHub projects — like making Telegram bots for managing bitcoin wallets or tools for computer games.

Malicious actors are making hundreds of fake projects on GitHub aiming to snare private info through crypto and credential-stealing malware, says Kaspersky.

Cybercriminals are using a sneaky new method to trick developers into downloading dangerous malware. A recent campaign called GitVenom is spreading harmful software through fake GitHub repositories. These attackers create fake open-source projects that look real but secretly contain hidden threats.