Scammers take to GitHub to hoodwink other cybercriminals TechRadar Skip to main content TechRadar is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Here's why you can trust us. Scammers take to GitHub to hoodwink other cybercriminals By Sead Fadilpašić published 4 October 2022 There's no PoC for the latest Microsoft Exchange flaw (Image credit: Gustavo Frazao / Shutterstock) Audio player loading… Cybersecurity researchers have discovered multiple GitHub accounts selling fake proof-of-work concept exploits for the latest zero-day vulnerabilities discovered in Microsoft Exchange. The warning follows the discovery of two new zero-day vulnerabilities in Microsoft Exchange: CVE-2022-41040 and CVE-2022-41082. These are a server-side request forgery (SSRF) flaw, and remote code execution (RCE) flaw, with both said to be being used by threat actors in the wild. Microsoft confirmed the existence of both the flaws and threat actors using it, and said to be working on a patch (opens in new tab). Until that happens, it won't share more details about the vulnerabilities, so as to not to give any new ideas to hackers - however, some saw this as an opportunity to make a quick buck. Fake accounts selling fake exploits As reported by BleepingComputer, researchers found at least two separate fraud campaigns: one comprised of five accounts looking to sell fake exploits ('jml4da', 'TimWallbey', 'Liu Zhao Khin (0daylabin)', 'R007er', and 'spher0x'), and another one impersonating Kevin Beaumont, aka GossTheDog, a popular cybersecurity expert. The GitHub repositories for sale luckily don't hold any malware (opens in new tab). They don't hold any important files either, just a README.md that details what's known about the vulnerabilities so far, and a pitch on how the crooks are selling a copy of a PoC exploit for the zero-days. Read more> More Microsoft Exchange zero-days exploited in the wild > Microsoft Exchange Online is making some major access changes > These are the best endpoint protection tools at the moment (opens in new tab) "This means it can go unnoticed by the user and potentially by the security team as well. Such a powerful tool should not be fully public, there is strictly only 1 copy available so a REAL researcher can use it: https://satoshidisk.com/pay/xxx," the document reads. The file then leads to a SatoshiDisk page where gullible hackers can "buy" the fake exploit for 0.0182 Bitcoin, or roughly $420. This should already be considered a red flag, as flaws like this one should cost at least a thousand times as much. Apparently, IT company Zerodium offers $250,000 for RCE flaws in Microsoft Exchange. Here are the best antivirus (opens in new tab) solutions right now Via: BleepingComputer (opens in new tab) Sead Fadilpašić Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he's written for numerous media outlets, including Al Jazeera Balkans. He's also held several modules on content writing for Represent Communications. See more Computing news Are you a pro? Subscribe to our newsletter Sign up to theTechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Thank you for signing up to TechRadar. You will receive a verification email shortly. There was a problem. Please refresh the page and try again. MOST POPULARMOST SHARED1One of the world's most popular programming languages is coming to Linux2Apple October launches: the new devices we might see this month3Google's AI editing tricks are making Photoshop irrelevant for most people4You may not have to sell a body part to afford the Nvidia RTX 4090 after all5The iPhone 14 Pro is made of the wrong stuff; the Pixel 7 proves that to me1We finally know what 'Wi-Fi' stands for - and it's not what you think2Best laptops for designers and coders 3Miofive 4K Dash Cam review4Logitech's latest webcam and headset want to relieve your work day frustrations5Best offers on Laptops for Education – this festive season Technology Magazines (opens in new tab)● (opens in new tab)The best tech tutorials and in-depth reviewsFrom$12.99 (opens in new tab)View (opens in new tab)