Analyzing malicious GitHub PR comments with GHArchive

malicious_github_comments.md

Today I found multiple annoying comments under one of my GitHub issues:

It looks like a spambot posting links to a malware. Googling reveals that I am not the only one:

Luckily there exists a handy tool for investigating this incident: Clickhouse provides a public dataset aggregating everything happened on GitHub. To connect to their public instance:

clickhouse-client --secure --host play.clickhouse.com --user explorer 

Who posted these comments?

SELECT DISTINCT actor_login
FROM github_events
WHERE (event_type = 'IssueCommentEvent') AND (file_time >= '2024-08-21 10:00:00') AND (body LIKE '%In the installer menu, select "gcc."')

┌─actor_login────┐
│ AlecsSantos    │
│ esttemanb      │
│ darkstorm4hack │
│ Zoraaa-z       │
│ diablo00001    │
│ Gamez2         │
└────────────────┘

The malicious comments are posted by 6 distinct accounts.

When are the comments created?

SELECT
    toDate(created_at),
    COUNT(*),
    bar(COUNT(*), 0, 300, 30)
FROM github_events
WHERE (event_type = 'IssueCommentEvent') AND (file_time >= '2024-08-21 10:00:00') AND (body LIKE '%In the installer menu, select "gcc."')
GROUP BY toDate(created_at)

┌─toDate(created_at)─┬─COUNT()─┬─bar(COUNT(), 0, 300, 30)───────┐
│         2024-08-25 │    2199 │ ██████████████████████████████ │
└────────────────────┴─────────┴────────────────────────────────┘

1 row in set. Elapsed: 0.344 sec. Processed 460.67 million rows, 5.90 GB (1.34 billion rows/s., 17.14 GB/s.)

All of the comments still on GitHub are created today (Aug 25th).

Listing malicious comments

SELECT
    created_at,
    repo_name,
    number,
    actor_login,
    body
FROM github_events
WHERE (event_type = 'IssueCommentEvent') AND (file_time >= '2024-08-21 10:00:00') AND (body LIKE '%In the installer menu, select "gcc."')
ORDER BY created_at ASC
INTO OUTFILE '/tmp/malicious_github_comments_2.csv'
2199 rows in set. Elapsed: 0.343 sec. Processed 460.67 million rows, 5.90 GB (1.34 billion rows/s., 17.22 GB/s.)

Please check the csv file below.

malicious_github_comments_2.csv