GitVenom Malware Used Fake GitHub Repos to Steal Bitcoin

Kaspersky flagged a single transaction in November 2024 where approximately 5 BTC, worth roughly $485,000 at the time, was transferred to a wallet controlled by the attackers. Infections have been detected globally, with notable concentrations in Russia, Brazil, and Turkey.

For individual investors, the immediate fix is to verify wallet addresses character by character before confirming a transaction. A hardware wallet that displays the destination address on its own screen provides an extra layer of verification that software alone cannot match, the researchers noted.

The campaign has been active since at least 2023. GitVenom's operators created repositories that looked busy and credible, writing code across multiple programming languages. The goal was to make developers clone the repo without a second thought, Kaspersky said.

For developers, supply chain attacks like GitVenom exploit dependency on third-party code by hiding malicious functionality inside seemingly useful libraries. As long as open-source code sharing remains a cornerstone of development, threat actors will continue to use it as a distribution channel, the researchers said.