SlowMist says fake Qwen 27B GitHub repos were used to spread StealC malware
SlowMist has disclosed a malware campaign that used GitHub repositories disguised as local quantized Qwen 27B model downloads to deliver StealC infostealer payloads. According to the security firm, one of the fake model files was only 487KB, far smaller than a normal Q4_K_M 27B model weight file, which should be more than 16GB. Instead of model weights, the archive contained a batch file, a renamed LuaJIT interpreter, and an obfuscated Lua script disguised as cert.txt. SlowMist said the malware could collect host information, capture screenshots, and upload data to a command-and-control server. If the preset C2 server became unavailable, the program could query a backup C2 address from a Polygon smart contract using eth_call, allowing the attackers to rotate malicious infrastructure through on-chain transactions. The follow-on payload was attributed to StealC, which can steal browser credentials, cookies, browsing history, email, WinSCP and Steam credentials, as well as crypto wallet files and browser extension data. SlowMist said it found 29 similar malicious archives across 23 GitHub repositories.
