Manufactured credibility: detecting fabricated Git history in an active software supply chain campaign

Thursday 15 October 16:00 - 16:30, Green room

George Karagiannidis & Evangelos Ganiaris (TwelveSec)

Software supply chain compromises increasingly target the developer workflow itself, exploiting trust in code repositories and common editor configurations. A client engagement that began with the triage of a single suspicious repository ultimately exposed an active, multi-stage intrusion campaign aimed at software engineers through malicious code repositories. At the time of writing, the campaign remained active, with observed infrastructure live until at least 30 August 2026. The initial lure consisted of a purported "technical assessment" repository. Its .vscode/settings.json file was configured to silently execute a remote script as soon as the victim opened an integrated terminal, providing the attacker with immediate code execution in the developer's environment.

Rather than relying solely on a convincing social-engineering pitch, the operators manufactured apparent legitimacy at the repository level. Four linked repositories contained approximately 800 commits of entirely synthetic development history, attributed to three real, long-standing software engineers whose names and email addresses were forged into the commit metadata. A prospective victim examining the organization or its public activity would encounter months of seemingly genuine work by apparently credible individuals, substantially lowering suspicion.

That same synthetic history, however, proved to be the operation's most reliable weakness. This paper presents a metadata-based method for distinguishing fabricated Git history from roughly 10,000 legitimate commits collected for comparison. The technique is corroborated by two additional evidence sources a) domain registration records and b) platform provenance. Using the accompanying tool, we further identified public GitHub repositories hosting malicious code with similarly forged histories. While these repositories match the campaign's methodology, whether they are being actively used in ongoing attacks at present cannot be confirmed.

We then describe the recovered second-stage payload in detail: an infostealer designed to harvest browser credentials, SSH keys, and data from more than 20 cryptocurrency wallets, and we provide detection guidance that remains effective even as the attackers rotate their infrastructure.

The campaign itself belongs to a threat family that has already been publicly documented. To our knowledge, however, the specific method by which the operators manufacture repository credibility, and a practical approach for detecting that manufacture, have not been previously published.

The main contributions of this paper are as follows:

• A reusable technique for identifying fabricated Git history. The method exploits a timestamp artefact introduced by the generation tooling, and is independently corroborated by two evidence sources: a) domain registration records and b) platform provenance. Neither source relies on probabilistic reasoning. An accompanying tool implementing these checks is presented.
• Detailed analysis of the second-stage payload, recovered from a live command-and-control endpoint and deobfuscated in an isolated environment, including its complete endpoint map and target list.
• Detections that outlive the infrastructure. While every domain referenced in this paper can be rotated in an afternoon, the observed behaviours cannot. All related indicators of compromise are shared to support defender operations.

George Karagiannidis George is a principal cyber security consultant at TwelveSec and also serves as the company's Chief Science Officer. He holds an M.Sc. in cybersecurity. He is a seasoned penetration tester and security researcher with extensive experience leading and delivering information security projects that range from system, network, and web application penetration testing to reverse engineering, security architecture and design for critical information systems, and Information Security Management System (ISMS) implementation. In his role as Chief Science Officer, George provides scientific and methodological leadership for TwelveSec's incident response practice, shaping the investigative frameworks, analytical methods, and evidence standards applied across engagements. He has worked across a wide range of industries, including major Greek and Middle Eastern banks, telecommunications providers, the European Commission, and the US healthcare sector. He keeps pace with the latest developments in offensive security and is particularly interested in operating system internals, networking, programming, and reverse engineering. This focus allows him to apply cutting-edge techniques and develop innovative solutions to the complex challenges posed by today's rapidly evolving ICT landscape.

Evangelos Ganiaris Evangelos Ganiaris holds a B.Sc. in computer science and has been working as a penetration tester at TwelveSec for the past four and a half years. His interest in cybersecurity started in 2012, driven by curiosity about how things work and how easy it can be to break into them. His main areas of expertise are web application security and social engineering, with a focus on phishing and vishing. He enjoys approaching security from an attacker's perspective, finding unexpected ways to bypass protections, and understanding how small weaknesses can be turned into real-world attacks.

Back to VB2026 Programme page

Back to VB2026 conference page

Register for VB2026

Other VB2026 papers