{"id":"CMP-202611-cyizpm","kind":"campaign","aliases":[],"related":[],"title":"Malware posing as a 'Dev Toolkit - Background Service' steals developers' GitHub tokens and can spread itself into the victim's GitHub repos; live C2 panels at api.avonlo[.]com and 199.91.221[.]237 (MalwareHunterTeam)","description":null,"summary":"MalwareHunterTeam reported on 10 Nov 2026 a malware sample whose code calls itself a 'Dev Toolkit - Background Service' ('Configuration sync and telemetry service') but has C2 and victim handling, steals the victim's GitHub token and has an 'Auto-spread' option that pushes itself into the victim's GitHub repos with that token. Two web panels titled 'C2' were found on port 3000. A related sample was uploaded to MalwareBazaar by @smica83. How it reaches victims (npm or other package, extension, fake repo), the platforms it runs on, and confirmed victims are unknown so far.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"GitHub","fixed":[],"ecosystem":"saas"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Network traffic or DNS to api.avonlo[.]com (http://api.avonlo[.]com:3000/) or 199.91.221[.]237 port 3000. A process or service describing itself as 'Dev Toolkit - Background Service' or 'Configuration sync and telemetry service'. In GitHub, commits or new files pushed to your repos that nobody on the team made, and unexpected token use in the GitHub audit log. Delivery channel and file hashes not public yet (sample is on MalwareBazaar via @smica83).","fix":"Block api.avonlo[.]com and 199.91.221[.]237. If a machine talked to them or runs that 'Dev Toolkit' service: isolate it, revoke and reissue its GitHub tokens (PATs, gh CLI, OAuth) and other credentials on it, and review recent pushes to every repo that account can write to. Turn on branch protection so a stolen token cannot push straight to default branches.","status":"open","published_at":null,"first_seen_at":"2026-11-10T11:19:36+00:00","triaged_at":"2026-11-10T11:19:36+00:00","updated_at":"2026-11-10T11:20:30+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-10T12:03:11Z","path":"unknown","entry":"unknown","reason":"The record says the delivery channel and how it reaches victims are unknown so far, and it does not state how the attacker got into any breached organisation, though it describes the token theft and Auto-spread behaviour.","history":[{"at":"2026-11-10T11:22:13Z","path":"unknown","entry":"unknown","confidence":0.9}],"confidence":0.8}},"analyst_status":"done","analyst_note":null,"search":"'-202611':34A '10':44B '199.91.221':30A '2026':46B '237':31A '3000':104B 'api.avonlo':27A 'auto':80B 'auto-spread':79B 'background':7A,57B 'c2':24A,66B,99B 'call':52B 'campaign':37B 'cmp':33A 'code':51B 'com':28A 'configur':59B 'confirm':131B 'cyizpm':35A 'dev':5A,55B 'develop':10A 'earli':39B 'early-warn':38B 'extens':122B 'fake':123B 'far':136B 'found':101B 'github':11A,21A,36A,74B,90B 'handl':69B 'live':23A 'malwar':1A,48B 'malwarebazaar':111B 'malwarehunterteam':32A,41B 'nov':45B 'npm':118B 'option':82B 'packag':121B 'panel':25A,97B 'platform':126B 'port':103B 'pose':2A 'push':84B 'reach':116B 'relat':106B 'repo':22A,91B,124B 'report':42B 'run':128B 'sampl':49B,107B 'servic':8A,58B,63B 'smica83':113B 'spread':15A,81B 'steal':9A,70B 'sync':60B 'telemetri':62B 'titl':98B 'token':12A,75B,94B 'toolkit':6A,56B 'two':95B 'unknown':134B 'upload':109B 'victim':19A,68B,72B,88B,117B,132B 'warn':40B 'web':96B 'whose':50B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["github"],"ptokens":["github"],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"malware","search_a":"'-202611':34A '199.91.221':30A '237':31A 'api.avonlo':27A 'background':7A 'c2':24A 'cmp':33A 'com':28A 'cyizpm':35A 'dev':5A 'develop':10A 'github':11A,21A,36A 'live':23A 'malwar':1A 'malwarehunterteam':32A 'panel':25A 'pose':2A 'repo':22A 'servic':8A 'spread':15A 'steal':9A 'token':12A 'toolkit':6A 'victim':19A","search_b":"'10':44B '2026':46B '3000':104B 'auto':80B 'auto-spread':79B 'background':57B 'c2':66B,99B 'call':52B 'campaign':37B 'code':51B 'configur':59B 'confirm':131B 'dev':55B 'earli':39B 'early-warn':38B 'extens':122B 'fake':123B 'far':136B 'found':101B 'github':74B,90B 'handl':69B 'malwar':48B 'malwarebazaar':111B 'malwarehunterteam':41B 'nov':45B 'npm':118B 'option':82B 'packag':121B 'panel':97B 'platform':126B 'port':103B 'push':84B 'reach':116B 'relat':106B 'repo':91B,124B 'report':42B 'run':128B 'sampl':49B,107B 'servic':58B,63B 'smica83':113B 'spread':81B 'steal':70B 'sync':60B 'telemetri':62B 'titl':98B 'token':75B,94B 'toolkit':56B 'two':95B 'unknown':134B 'upload':109B 'victim':68B,72B,88B,117B,132B 'warn':40B 'web':96B 'whose':50B","search_c":"","cause_entry":"unknown","cause_path":"unknown","disclosures_checked_at":null,"first_public_at":"2026-11-10T10:56:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-cyizpm","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-10T11:19:36+00:00","fetched_at":"2026-11-10T11:19:36+00:00","note":null}],"documents":[{"id":114572,"url":"https://x.com/malwrhunterteam/status/2120109771848134834","title":"@malwrhunterteam: And @smica83 uploaded a related sample to Bazaar: https://t.co/kb0fTW7bWr","kind":"post","source":"x","publisher":null,"text":"And @smica83 uploaded a related sample to Bazaar: https://t.co/kb0fTW7bWr\n\nlikes 0 reposts 0","published_at":"2026-11-10T11:02:14+00:00","relation":"describes","confidence":null,"note":null},{"id":114573,"url":"https://x.com/malwrhunterteam/status/2120109623713636783","title":"@malwrhunterteam: Starts with \"Dev Toolkit - Background Service\" and \"Configuration sync and telem","kind":"post","source":"x","publisher":null,"text":"Starts with \"Dev Toolkit - Background Service\" and \"Configuration sync and telemetry service.\" comments, but a little later already mentioning things like \"C2\" and \"victim\"...\n😂\n\"Auto-spread: if true, automatically spread to victim's GitHub repos after stealing token\"\n🤔\n🤷‍♂️ https://t.co/dblv8gGMhw\n\nlikes 0 reposts 0","published_at":"2026-11-10T11:01:38+00:00","relation":"describes","confidence":null,"note":null},{"id":114574,"url":"https://x.com/malwrhunterteam/status/2120108684231725278","title":"@malwrhunterteam: 🤷‍♂️ https://t.co/VHzmM5Quqf","kind":"post","source":"x","publisher":null,"text":"🤷‍♂️ https://t.co/VHzmM5Quqf\n\nlikes 0 reposts 0","published_at":"2026-11-10T10:57:54+00:00","relation":"describes","confidence":null,"note":null},{"id":114575,"url":"https://x.com/malwrhunterteam/status/2120108206466925028","title":"@malwrhunterteam: Some panel simply titled \"C2\":\nhttp://api.avonlo[.]com:3000/\nhttp://199.91.221[.","kind":"post","source":"x","publisher":null,"text":"Some panel simply titled \"C2\":\nhttp://api.avonlo[.]com:3000/\nhttp://199.91.221[.]237:3000/\n🤷‍♂️ https://t.co/NCreDJHQeb\n\nlikes 4 reposts 1","published_at":"2026-11-10T10:56:00+00:00","relation":"describes","confidence":null,"note":null},{"id":114729,"url":"https://x.com/malwrhunterteam/status/2120118359861649442","title":"@malwrhunterteam: And @smica83 uploaded a related sample to Bazaar: https://t.co/e5N2l78dBS","kind":"post","source":"x","publisher":null,"text":"And @smica83 uploaded a related sample to Bazaar: https://t.co/e5N2l78dBS\n\nlikes 1 reposts 0","published_at":"2026-11-10T11:36:21+00:00","relation":"discussion","confidence":null,"note":"MHT points to related MalwareBazaar sample from @smica83, already noted"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}