Search GitHub for a coding tool, pick a project that looks completely real, download its zip file, and you quietly get a trojan instead. A security researcher found about 10,000 fake GitHub projects doing exactly that. Each one is a near-perfect copy of a real project, built to fool you into trusting it.
Each fake steals everything that makes a project look safe. It copies a real project's name, description, and full edit history, and even lists the original author as a helper. None of them are marked as copies, and that mark is the usual sign.
The first fakes that the researcher, Orchid, watched kept re-posting the same small change to the readme, the front page of a project, every few hours. Later fakes did not always follow that schedule.
How the trick hides
The zip file carries the attack. Orchid found samples that held four files, including a launcher and a loader. Related samples logged by Hexastrike used three or four files. Here is why it slips through. Paste the zip's download link into VirusTotal, the free site that scans files for malware, and it reports zero viruses. Upload the actual zip and it flags the trojan inside. Anyone who only checks the link sees nothing wrong.
Finding the fakes by hand was not realistic. Checking hundreds of millions of projects at GitHub's public rate limit would take years. So the researcher used GH Archive, a service that publishes every GitHub event for each day, then filtered for projects that pushed a fresh change every few hours and matched the rest of the pattern. The full script and the list of bad projects are now posted on GitHub.
Orchid says GitHub support did not reply for two weeks, and the fakes came down only about a month later. The simple rule: do not download and run a zip linked from a project's readme, even when it looks real and names someone you know. Get tools from the official source, and treat a readme that keeps re-adding a download link as a warning.
