Attackers Deploy Destructive Windows Malware While Targeting GitHub Developer Accounts

A Multi-Threat Attack Campaign Emerges

Security researchers at Datadog have discovered a coordinated attack operation that combines three dangerous elements: a malicious Windows program called GigaWiper that can erase your hard drive, fake ransom warnings designed to trick victims, and spyware that steals sensitive information. The threat actors behind these campaigns are systematically targeting software developers by hunting through GitHub—the popular platform where millions of programmers store and collaborate on code.

The attackers are using automated tools to search GitHub, looking for corporate accounts, code repositories, and developer profiles. They're mimicking legitimate traffic patterns to avoid detection, essentially walking through GitHub's front door rather than breaking through a window. Once they identify targets, they're deploying this multi-layered malware that can simultaneously steal data and destroy files.

Understanding the Three-Part Threat

Think of this attack like a burglar who not only steals your valuables but also floods your house and leaves a fake insurance claim. The GigaWiper malware serves three purposes simultaneously:

• File destruction: It wipes your disk clean, similar to erasing all the files from your computer
• Deceptive ransom screens: It displays fake messages claiming your data is locked, trying to panic victims into paying money
• Information harvesting: It quietly copies sensitive files and credentials before destroying everything

Developers are especially valuable targets because they often have access to proprietary source code, security credentials, and private repositories containing sensitive business information.

Why This Matters to You

If you work in software development or your company relies on GitHub for code management, this campaign directly threatens your organization. The attackers aren't just after one person—they're running multiple synchronized operations targeting numerous companies at once.

This is particularly dangerous because developers often have elevated permissions within their companies. When their accounts are compromised, attackers gain access to the crown jewels: unreleased software, security vulnerabilities in code, API keys that unlock other systems, and customer data that might be referenced in repositories.

The combination of data theft before destruction also suggests these attackers plan to profit twice—first by selling stolen information on the dark web, then by attempting extortion through the fake ransom messages.

Steps You Should Take Now

• Enable two-factor authentication: Add an extra security layer to your GitHub account so attackers can't access it even with your password
• Review your repositories: Check for any suspicious activity, unauthorized access, or unexpected file changes
• Audit credentials: Rotate any API keys, tokens, or credentials stored in or referenced by your repositories
• Update Windows systems: Ensure your operating system and security software are fully patched with the latest updates
• Monitor for strange behavior: Watch for unexpected system slowdowns or disk activity, which could indicate malware running
• Alert your security team: Share this information with your IT and security departments so they can prepare defenses

Organizations should treat their GitHub accounts with the same security rigor as their primary network infrastructure, since attackers clearly view developer platforms as high-value entry points into corporate systems.