Hackers Hack Hackers: MUT-1244 Steals Credentials in Deceptive GitHub Attack

Datadog Security Labs attributes a year-long campaign to the criminal group MUT-1244 that targeted security researchers, penetration testers and other attackers by publishing convincing fake GitHub PoCs and sending phishing lures; the campaign delivered malware (miner/backdoor) that exfiltrated ~390,000 WordPress credentials, private SSH keys, AWS credentials and other sensitive data to external services, and remains active with hundreds of systems likely infected.