HACKERAI Malware Uses GitHub Gists for Stealthy Command and Control
A new malware framework, HACKERAI C2 Agent, has been discovered leveraging GitHub Gists for command-and-control, blending malicious traffic with legitimate activity in espionage campaigns targeting South Asia.
A sophisticated new malware framework, dubbed HACKERAI C2 Agent, has emerged, employing a novel technique to establish command-and-control (C2) channels by utilizing GitHub Gists. This method allows attackers to mask their malicious communications within the legitimate traffic of a widely used development platform, significantly complicating detection and analysis for security professionals. The discovery was made during an investigation into a broader espionage campaign that has been targeting organizations across South Asia, with specific focus on the telecom, government, defense, energy, and critical infrastructure sectors.
The campaign's initial entry vector involved luring victims with carefully crafted files that impersonated trusted entities such as telecom service providers, government updates, and software installers. Researchers at Acronis identified HACKERAI alongside two related malware families, PATCHCORD and SHEETCORD, noting that the overall activity bears moderate confidence of overlap with APT36, also known as Transparent Tribe, a threat actor with a history of targeting regional government and defense interests.
What sets HACKERAI apart is its departure from traditional C2 infrastructure. Instead of relying on dedicated attacker-controlled servers, it leverages GitHub Gists – a feature designed for sharing small code snippets and text. This allows the malware to discreetly retrieve instructions from its operators and exfiltrate stolen data, making it difficult for network defenders to distinguish malicious traffic from benign GitHub activity.
The HACKERAI C2 Agent is equipped with functionalities to download tasks and upload collected information via these Gists. This means an infected system can periodically check a specific Gist for new commands, execute them, and then report the results back through the same clandestine channel. The malware is capable of gathering basic system information, executing remote commands, and establishing persistence through a technique involving the hijacking of browser shortcuts.
This shortcut hijacking allows the malware to launch automatically before the legitimate browser starts, while simultaneously initiating the actual browser. This dual action is designed to avoid raising suspicion from the end-user, who would see their expected browser session begin without any apparent anomaly.
Furthermore, researchers observed indicators suggesting that HACKERAI may have been developed with the assistance of AI coding tools. The malware sample contained AI-style comments, debugging messages, test code, and a hardcoded GitHub personal access token, hinting at the evolving methods in malware development. The use of legitimate cloud platforms for C2 is not a new tactic, but its effectiveness persists due to the difficulty in blocking these services without impacting legitimate operations.
The broader campaign has been observed expanding across South Asia, with evidence of fraudulent installers and archives targeting entities in Afghanistan and India. One lure impersonated Afghan Telecom, while another mimicked a Ministry of Defense update. The PATCHCORD implant, for instance, hijacks shortcuts for popular browsers like Edge, Chrome, and Firefox to ensure persistence. The SHEETCORD variant, written in Go, extends this to other browsers and uses Google Sheets for its C2 traffic.
Security teams are advised to monitor for unusual GitHub activity originating from endpoints, watch for modified browser shortcuts, and rigorously verify the authenticity of software installers received through various channels. The combination of social engineering, shortcut hijacking, potential AI-assisted development, and cloud-based C2 channels highlights a trend towards more evasive and harder-to-detect malware operations.