The GitVenom campaign: cryptocurrency theft using GitHub

GitVenom is an active campaign that lures developers with fake GitHub projects containing hidden loaders in multiple languages; the malicious repos download and execute payloads including a Node.js stealer (exfiltrates credentials and wallets), AsyncRAT and Quasar implants, and a clipboard hijacker. The actors used polished READMEs, frequent commits, and build-time execution to appear legitimate; telemetry shows global infection attempts (notably Russia, Brazil, Turkey) and confirmed financial theft (~5 BTC). Reference hashes for infected repository archives are provided.