Cybersecurity

Zscaler ThreatLabz researchers recently discovered a highly deceptive campaign leveraging the leak as a social engineering lure to target developers seeking access to the source code.

In this newly discovered campaign, attackers have established malicious GitHub repositories that masquerade as the authentic leaked repository.

One prominent page, published by a threat actor named idbzoomh, currently ranks near the top of search engine results for users attempting to find the files.

The repository promises an unlocked version of the enterprise software featuring no usage limits. Instead of legitimate code, the provided zip archive contains a Rust-based dropper executable.

Upon execution, this dropper deploys the Vidar information stealer to siphon sensitive credentials and GhostSocks to proxy network traffic.