Hacker News Reader

Comment by edelbitter | Hacker News Reader

Already used (sounds like, successfully) by the usual GitHub phishing campaigns:

> found a workaround for the shader compilation bug that keeps the mesh from vanishing. I attached the fix here.

https://github.com/carbonengine/trinity/issues/21

(Microsoft should stop it with the "This is not the web page you are looking for." where people specifically came looking to learn whether something was administratively blocked - or whether it is no longer available by choice of the affected party.)

View on HN

With all due respect, this reads to me as a couple of confusing non sequiturs. I took a quick look at the link you included, and it didn't help me understand what you're talking about either. Probably I'm just horrendously ignorant, but I would love to understand what you're referring to, and the point you're making about it.

The zip file referenced in https://github.com/carbonengine/trinity/issues/21#issuecomme... is probably malware, per https://github.com/carbonengine/trinity/issues/21#issuecomme... . I didn't sit there and decompile the thing but even just running "strings" on the .exe is more evidence in favor of that, it has things like domain names that a "driver" shouldn't have. Whether or not "procedural" is part of the scam or a legit victim, I have not much opinion.

The "issue" raised says "hey I found a bug, no ships are rendered, run this .exe file to fix it!" and someone did just that.

You don't run just random binaries off the Internet on your computers, do you?

Nooooo, of course you don't.

> You don't run just random binaries off the Internet on your computers, do you?

Humans might exercise some context-aware caution... AI agents, however?

It's not random, it's a fix for a bug in Eve!

Because we may be missing comments that GitHub has deleted without leaving tombstones (which sucks), it is not entirely clear whether the person creating and responding to the issue I linked is the person trying to have others run that trojan file, or whether they have fallen victim to it .. and merely quoted the link from a now-vanished comment.

In any case, this is the file they referenced, which is still all over GitHub under various "fix.exe" file names in likely LLM-generated issues and issue comments: https://www.virustotal.com/gui/file/d85d164e46fabb085609f258...

It's your comment which is deficient. I happen to know what you're referring to, but this and your GP comment are written as reminders for people who already know what you're talking about, rather than being explanatory for people who don't.

A better approach might have been It seems the usual suspects are still abusing Github pull requests to distribute malware [...]

you're the perfect victim

I appreciate your admiration, but I assure you I put on my pants one leg at a time.

I opened a bug in an unrelated repo yesterday and nearly immediately got hit with one of those. Kinda wish I'd downloaded the zip before it got deleted. I'm curious what the attack was.

I ignored it because it wasn't a pull request or patch file, it came too fast, and the explanation misidentified the source of the problem.

Pains me to see it play out like this. Crazy simple, and effective.

Reply on news.ycombinator.com