GitHub Hacked, Spreads Malicious Syscoin Windows Installers

Cryptocurrency Syscoin announced that the official release of Syscoin 3.0.4.1 (detection name: TSPY_HPFAREIT.SM4) was compromised from June 9, 2018 to June 13, 2018, after an “Unknown Publisher” hacked into Syscoin’s legitimate GitHub account. The hacker then replaced the official files with modified versions that infected machines with either a keylogger or ransomware when executed. Developers who executed the modified installers on the identified dates were advised to back up their files and check that they did not release projects with the malicious code, run an antivirus scan to remove the infected files, and change their online wallet passwords.

Syscoin discovered the malware after they were notified that the installers were being flagged as malicious. Further investigations showed that the modified files were made available on the Syscoin GitHub page on June 9. Once executed, it prompts for a login password after restarting even without setting anything up. During login, it renames itself as “Antimalware Service Executable” in the task manager.

[Related: Update now: Git vulnerability can be used for remote code execution]

Mac and Linux Syscoin versions are safe, but it affects Windows users who executed the modified versions. Researchers warn that the code could affect blockchain projects, unencrypted wallets, and other released cryptocurrency projects. According to the report, Syscoin developers and GitHub staff will start implementing 2FA authentication, routine signature hash verification, and will begin working together to check for altered releases.