FAKE Gambling Cheat Runs Malware

Keypoints :

• The GitHub repository “Limbo Casino Predictor Strategies” included malware exploiting Visual Studio deserialization vulnerabilities.
• Malware used the Suo exploit, running malicious code automatically upon opening solution files in Visual Studio.
• Decrypted payloads reveal stages of infection, including remote access Trojans like Remos RAT and other malicious binaries.
• The malware infrastructure relies on social media and GitHub repositories to host and stage malicious payloads.
• Advanced techniques involve PowerShell scripts downloading, decrypting, and executing malicious code from command and control servers.
• Active promotion and distribution of malware via Instagram, Telegram, and YouTube links, often embedded in social media posts.
• The attack chain includes sophisticated obfuscation, staged payloads, and the exploitation of old, sometimes obsolete, repositories and accounts.