“Webrat” Trap: Hackers Lure Junior Security Researchers with Fake GitHub Exploits

The “Webrat” malware campaign has evolved from disguising itself in game cheats to a trap that targets students and junior security researchers by presenting fake PoC exploits for high-profile vulnerabilities. According to Kaspersky Labs, the operators pivoted in October 2025 to set up malicious GitHub repositories that host exploits for vulnerabilities with high CVSS scores, including CVE-2025-59295 (CVSS 8.8), CVE-2025-10294 (CVSS 9.8), and CVE-2025-59230 (CVSS 7.8).

The lures are designed to appear genuine by including detailed vulnerability information in their descriptions and by offering “working” code that promises access to the latest flaws. The campaign relies on the victim’s willingness to run unverified code, with the malware remaining a basic backdoor despite the sophisticated presentation. Researchers warn that seasoned professionals would likely spot the deception, and advise analysing new exploits in isolated environments and avoiding broad antivirus exclusions.