New Redline Version: Uses Lua Bytecode, Propagates Through GitHub

A new packed Redline version was found in the wild and it has new tricks that may make it challenging to detect. 

What’s new? 

McAfee Labs recently discovered a new Redline Stealer variant that uses Lua bytecode to hide its malicious code. This is the first time we’ve seen this technique used in Redline Stealer. 

The malware was also found on GitHub, inside Microsoft’s official vcpkg repository: https[:]//github[.]com/microsoft/vcpkg/files/14125503/Cheat.Lab.2.7.2.zip.  

The attackers uploaded a malicious zip file named Cheat.Lab.2.7.2.zip to …

bytecode code detect found github hide in the wild labs lua malicious may mcafee redline redline stealer stealer version