StepSecurity launches tools to find malicious files left by attacks

StepSecurity has launched Malicious Files for GitHub in beta, alongside a renamed and expanded Malicious Files feature in its Dev Machine Guard product. The tools are designed to detect files left by supply-chain campaigns in repositories and on developers’ computers. StepSecurity says attackers increasingly hide malicious code in editor settings, altered project files and injected GitHub Actions workflows, rather than relying only on package installation scripts. Such files may run when a developer opens a project or when a workflow is triggered.

The GitHub scanner checks file versions across repository history, branches, pull requests and tags against detection rules maintained by StepSecurity. Its findings show where a file appears, the commit that introduced it, the author and date, and which rule checks matched. The company says its rules cover campaigns including Miasma, Mini Shai-Hulud, ForceMemo, Megalodon and GhostAction.

For example, its Miasma rule checks for IDE configuration files, a command running the worm’s loader and an automatic execution trigger; three of five checks must match. Findings can be filtered and exported, and remain recorded for 180 days after the file disappears from all refs.

The Dev Machine Guard feature lists detections by device, user and operating system, with confidence levels and details including file paths, SHA-256 hashes and matched indicators. Administrators can deactivate rules across enrolled devices and later reactivate them. StepSecurity recommends investigating repositories and machines under the same campaign, removing affected files from both, and rotating credentials for the pushing account and affected machines. The machine feature runs on macOS, Windows and Linux.