Malicious Fork of Legitimate Triton App Discovered on GitHub, Exposing New Malware Threat

Why It Matters

The incident demonstrates how trusted open‑source ecosystems can be weaponized to deliver cross‑platform malware, forcing organizations to tighten code‑supply‑chain verification. It underscores the need for vigilant repository monitoring to prevent credential‑stealing and data‑exfiltration threats.

Key Takeaways

• Malicious fork disguises Windows malware as macOS client
• Attack leverages GitHub forking and misleading README links
• Payload delivered via password‑protected ZIP named Software_3.1.zip
• Detection rate low: 12/66 AV engines on VirusTotal
• Recommendations include verifying repo owners and monitoring IOCs

Pulse Analysis

Open‑source platforms like GitHub have become essential for rapid software development, yet they also present an attractive attack surface for threat actors. By forking a legitimate project and subtly altering the README, the adversary exploits the trust developers place in familiar repositories. This technique bypasses traditional code‑signing checks because the malicious code is delivered as a raw ZIP rather than a compiled binary, blurring the line between legitimate updates and malicious payloads. Such cross‑ecosystem abuse—macOS branding for Windows malware—highlights a growing supply‑chain risk that extends beyond language or OS boundaries.

The embedded malware exhibits sophisticated evasion tactics. After extraction with 7za.exe, a batch launcher invokes luajit.exe, enabling scripted actions while checking for debuggers, virtual machines, and sandbox environments. Its behavior maps to MITRE ATT&CK techniques for execution, defense evasion, discovery, and command‑and‑control, including T1059 (script execution) and T1497 (virtualization checks). Network traffic blends with legitimate Office and blockchain services, using domains like nexusrules.officeapps.live.com and polygon‑rpc.com to mask C2 communications. The low detection rate on VirusTotal suggests that many security products lack signatures for this specific payload, increasing the chance of successful infiltration.

Mitigation requires a multi‑layered approach. Security teams should enforce strict provenance checks, confirming repository ownership, commit history integrity, and the presence of signed release assets. Automated monitoring for anomalous download links, especially raw asset URLs in READMEs, can flag potential abuse. Endpoint detection should include indicators such as 7za.exe, luajit.exe, and the specific SHA‑256 hash of the ZIP file, while network defenses must scrutinize traffic to the identified Office and blockchain endpoints. By integrating these controls, organizations can reduce the risk of supply‑chain compromise and protect against emerging cross‑platform malware campaigns.