Security Alert: Active Malware Campaign Exploits GitKraken

A widespread malware campaign is actively abusing DLL side-loading techniques through a signed GitKraken ahost.exe binary. Attackers place a malicious libcares-2.dll file in the same directory to hijack the DLL search order and bypass signature verification mechanisms, allowing arbitrary code execution.

The campaign uses invoice and RFQ-themed phishing lures to distribute info-stealing malware and Remote Access Trojans (RATs). This poses a significant risk to developers and enterprises relying on Git-based tools for version control and collaboration.

Web3 developers using GitKraken should exercise caution with suspicious file attachments and verify the integrity of executable files from trusted sources only. Keep your development tools updated and monitor system behavior for unauthorized DLL loading activities.