Monday, April 15, 2024

Hackers Abuse GitHub Codespaces Feature to Host and Deliver Malware

Trend Micro researchers have recently demonstrated that malware and malicious scripts can be hosted and distributed within GitHub Codespaces by malicious actors through the use of port forwarding functionality.

GitHub Codespaces allows developers to quickly set up a workspace and start coding directly within minutes in a web browser, without having to worry about setup, configuration, and dependencies. 

This makes it much easier and faster to get started with a project, and it also reduces the need for developers to switch between different development environments.

Malware Server Hosted on GitHub Codespaces

GitHub Codespaces provide developers with cloud-hosted development environments that are easily accessible and can be quickly configured. 

This makes them an attractive target for malicious actors who can use them to quickly set up malicious web servers, which can be used to distribute malware or other malicious content without detection.

In this scenario, researchers have shown that by configuring a Codespace to act as a web server, an attacker could potentially use it to serve up malicious files or links that would be difficult for security systems to detect, because the traffic would appear to be coming from a legitimate source. 

GitHub Codespaces allows developers to create and manage development environments in the cloud directly from the GitHub platform. One of the key features of Codespaces is the ability for developers to forward TCP ports to the public internet. 

This means that developers can make their applications running on the Codespace available to external users by forwarding a specific port from the Codespace to the public internet. 

This is useful for setting up an environment for testing code, as well as for making applications accessible to others. By configuring the port as private, the URL can be shared with specific individuals, while public ports are accessible to anyone with the URL.

The main difference between a private and a public port forward is the security provided by the authentication requirement. A private port forward is much more secure since it limits access to only those who have the token or cookies, while a public port forward is open to anyone who knows the URL.

The following are possible actions an attacker could perform in theory:-

  • Run a simple Python web server
  • Upload malicious scripts or malware to their Codespace
  • Open a web server port on their VM
  • Assign it “public” visibility

Developers have the option to set the Codespaces port-forwarding system to HTTPS instead of HTTP by default. This will create the illusion that the URL is secure with respect to hackers.

The secure nature of GitHub allows threat actors to evade detection at a minimal cost since antivirus tools are less likely to raise alarms as GitHub is a trusted space.

Increasing the Attack’s Intensity

It is also possible for Trend Micro analysts to enhance their malware distribution operations by abusing the Dev Containers within GitHub Codespaces.

This tool is available to developers for quick deployment, sharing with others, and connecting to a VCS system. There are a number of things that an attacker can do by using a script, including the following:- 

  • Forward a port
  • Run a Python HTTP server
  • Download malicious files inside their Codespace

Now a web server with an open directory containing malicious files is created when the port’s visibility is set to public. 

An attacker can use the same URL for an entire month because GitHub’s policy is to automatically delete inactive codespaces after 30 days. However, in response to reports of security vulnerabilities, GitHub commits to investigating them. 

The company is aware of this report and plans to add a prompt to users when connecting to a codespace that asks them to confirm that they have trust in the owner.


Here below we have mentioned some best security practices that IT and security teams can implement to prevent future threats from abusing this platform:-

  • Whenever possible, use trusted code sources, such as extensions like VSCode extensions and GitHub repositories.
  • In order for developers to work with untrusted code properly, they should be aware of the repository they are working on and be careful when doing so.
  • Devcontainer configuration is based upon the use of container images, which should be recognized and maintained in accordance with the requirements.
  • For GitHub, you should always use passwords that are unique and strong.
  • Adding two-factor authentication to your account is a great way to increase its security.
  • In order to avoid credential leaks, it is necessary to avoid committing secrets and credentials publicly.

Network Security Checklist – Download Free E-Book


Latest articles

Hacker Customize LockBit 3.0 Ransomware to Attack Orgs Worldwide

Cybersecurity researchers at Kaspersky have uncovered evidence that cybercriminal groups are customizing the virulent...

Microsoft .NET, .NET Framework, & Visual Studio Vulnerable To RCE Attacks

A new remote code execution vulnerability has been identified to be affecting multiple Microsoft...

LightSpy Hackers Indian Apple Device Users to Steal Sensitive Data

The revival of the LightSpy malware campaign has been observed, focusing on Indian Apple...

LightSpy Malware Attacking Android and iOS Users

A new malware known as LightSpy has been targeting Android and iOS users.This sophisticated...

This Startup Aims To Simplify End-to-End Cybersecurity, So Anyone Can Do It

The Web3 movement is going from strength to strength with every day that passes....

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles