Fallout in github, Aug 17 – Aug 23

obfuscated crypto drainer in config

Font file hides crypto-stealer payload

Obfuscated crypto-stealer in font file

Malicious Node payload in font file

Malicious VS Code tasks and obfuscated payload

Malicious code disguised as font file

Obfuscated C2 payload in font file

Obfuscated payload auto-executes on open

Disguised crypto stealer in font file

Signed by Codeblog CORP, CDP, persistence

obfuscated payload in tailwind config

Obfuscated payload in postcss config

Malicious code in font file

Disguised dropper in font file

Malicious code hidden in font file

AMSI patching in embedded PE

Obfuscated backdoor: curl|bash, eval C2, prepare hook

Disguised Node execution on open

Malicious VS Code autorun payload

Malicious crypto drainer in font file

Fake antivirus redirects to malware

Malicious VSCode task executes hidden payload

Fake AV redirects to malware

Trojanized dependencies with exfiltration