Executive Summary
The ForceMemo campaign involves the takeover of developer GitHub accounts, likely through credentials stolen by the GlassWorm malware from compromised developer environments. The threat actor uses these stolen credentials to inject malware into the victims' Python repositories. The injection method is particularly stealthy, utilizing `git force-push` to rebase the latest legitimate commit with malicious code. This technique preserves the original commit author and message, making the change difficult to spot in the repository's history, with the primary indicator being a discrepancy between the author and committer dates.
The malware itself is a multi-stage infostealer. Upon execution, it deobfuscates its payload, which then queries a specific address on the Solana blockchain to retrieve a C2 URL from a transaction memo. This novel use of a public blockchain for C2 makes the instructions resilient to takedowns. The malware proceeds to download a Node.js runtime and a second-stage, AES-encrypted JavaScript payload, likely designed to steal cryptocurrency wallet data, browser credentials, and SSH keys. The campaign is linked to the GlassWorm threat actor, as it shares the same Solana C2 infrastructure.