{"id":272,"date":"2025-12-23T08:12:46","date_gmt":"2025-12-23T08:12:46","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/23\/from-cheats-to-exploits-webrat-spreading-via-github\/"},"modified":"2025-12-23T08:12:46","modified_gmt":"2025-12-23T08:12:46","slug":"from-cheats-to-exploits-webrat-spreading-via-github","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/23\/from-cheats-to-exploits-webrat-spreading-via-github\/","title":{"rendered":"From cheats to exploits: Webrat spreading via GitHub"},"content":{"rendered":"
\n

\"\"<\/p>\n

In early 2025, security researchers uncovered<\/a> a new malware family named Webrat. Initially, the Trojan targeted regular users by disguising itself as cheats for popular games like Rust, Counter-Strike, and Roblox, or as cracked software. In September, the attackers decided to widen their net: alongside gamers and users of pirated software, they are now targeting inexperienced professionals and students in the information security field.<\/p>\n

Distribution and the malicious sample<\/h2>\n

In October, we uncovered a campaign that had been distributing Webrat via GitHub repositories since at least September. To lure in victims, the attackers leveraged vulnerabilities frequently mentioned in security advisories and industry news. Specifically, they disguised their malware as exploits for the following vulnerabilities with high CVSSv3 scores:<\/p>\n\n\n\n\n\n\n
CVE<\/strong><\/td>\nCVSSv3<\/strong><\/td>\n<\/tr>\n
CVE-2025-59295<\/td>\n8.8<\/td>\n<\/tr>\n
CVE-2025-10294<\/td>\n9.8<\/td>\n<\/tr>\n
CVE-2025-59230<\/td>\n7.8<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

This is not the first time threat actors have tried to lure security researchers with exploits. Last year, they similarly took advantage of the high-profile RegreSSHion vulnerability<\/a>, which lacked a working PoC at the time.<\/p>\n

In the Webrat campaign, the attackers bait their traps with both vulnerabilities lacking a working exploit and those which already have one. To build trust, they carefully prepared the repositories, incorporating detailed vulnerability information into the descriptions. The information is presented in the form of structured sections, which include:<\/p>\n