Water Curse Group Weaponizes GitHub Repositories Inbox

Water Curse is a financially motivated threat group that weaponizes GitHub by hosting malicious repositories posing as legitimate developer tools. Once cloned and built, these projects execute obfuscated scripts that download and deploy multi-stage malware. The attack chain includes system recon, credential theft, privilege escalation, and persistence, with data exfiltrated via Telegram or public hosts. This campaign targets developers, security professionals, and crypto users through compromised open-source workflows.