The OpenSourceMalware Show #23

What it is

The transcript adds specifics to PolinRider's evasion technique, the Mac-Claude installer campaign, and the Bitget heist that the summary's one-liner doesn't carry.

How it works

PolinRider's fake-font payload has gone through a traceable evolution: originally always named fa-solid-400.woff2, DPRK first began rotating the number suffix (400 → 500 → 900 → 300) once defenders keyed detections to the exact filename. They then relocated the file from an easily-spotted top-level public/fonts folder to a path nested deep inside an existing legitimate folder in the repo (rather than a newly created one), and most recently swapped the .woff2 extension for .llf — an obscure, non-font format — while keeping the fa-solid- prefix. The repos are compromised via force-push, and some are repeatedly overwritten (one tracked repo changed from .woff2 to .llf within about three days). The campaign traces back to a "TasksJacker" lineage the researcher first documented in November of last year, with earlier sub-variants (e.g., fake .dic dictionary files) now resurfacing.

For the Claude Desktop lookalike: the signed DMG at claude-desktop.com is a repackaged copy of the real Claude installer with an added padded payload, hosted on GitHub infrastructure. The real installer is ~50MB; the malicious one is ~210MB (roughly 4x). Because it's Apple-signed, macOS installs it without warning. Apple has since revoked that signing certificate, so installation should now error.

For Bitget: SlowMist's incident report attributes initial access to a zero-day in an unnamed security product, which the host speculates (explicitly unconfirmed) may be a zero-trust VPN-replacement tool. Only hot/warm wallets were drained; cold wallets were untouched, and customer-facing balances still displayed as intact post-theft.

Preconditions / Affected

• PolinRider: affects GitHub repos where attackers can force-push (compromised credentials/tokens); detection relying on exact filename (fa-solid-400.woff2) or top-level public/fonts path will miss current variants.
• Claude installer: macOS users installing from claude-desktop.com rather than Anthropic's official source; signing-based trust was exploited until Apple revoked the certificate.

What to do

• Detection engineering should avoid single static filename/path matches; search should account for varying numeric suffixes, the new .llf extension, and nested (not just top-level) folder locations. The researchers note GitHub's search API itself is rate-limited and inconsistent for this kind of hunting (per-query limits around 1,000–4,000 results cited).
• Verify Claude Desktop installer size/source — legitimate DMG is ~50MB; anything near 200MB from a non-Anthropic domain should be treated as malicious regardless of valid signing.

Caveats

• The specific security product behind the Bitget zero-day is unnamed/unreleased by SlowMist; the VPN-tool attribution is the host's personal speculation, explicitly flagged as unconfirmed.
• GitHub repo counts for .llf-variant PolinRider payloads (127 found via search) are stated as undercounts due to API limitations and cover only public repos.