An exposed .git folder let us dox a phishing campaign

64•spirovskib•2mo ago

This past Friday afternoon, a member in our Discord server reported a phishing email pointing to a fake login page.

We took up to research it and because of clumsy decisions by the attacker we got their GitHub and their operational Telegram bot.

Screenshots: https://imgur.com/a/FTy4mrH

Sometimes the attacker incompetence can be a defender's best weapon ¯\_(ツ)_/¯

The phishing page was a standard clone of an "email", unbranded anf generic service. A bit of gobuster reconnaissance and we got the site's .git directory publicly accessible and listing its contents.

Inspecting of the requests also got us the first Telegram bot token. This is the digital equivalent of leaving the blueprints to your entire operation, including past versions and deleted files, lying on the front lawn.

We pulled the repository, found automated deployments and multiple fake pages with different hardcoded Telegram bot tokens and Chat IDs.

With the source code, repo and the active Telegram bot token, we filed detailed abuse reports:

- GitHub: We reported the repository containing the phishing kit's source code. It was taken down for violating TOS.

- Telegram: We reported the bot using the provided token and chat ID, leading to its removal.

- Hosting Provider: The malicious site was reported and taken offline.

Lesson learned? Never deploy a .git folder to production. Even if you are a criminal.

Acknowledgement: This was a collaborative effort by members of the BeyondMachines Discord community. The crowdsourced speed and collaboration helped us take this down very fast.

Comments

poly2it•2mo ago

Could've traced the attacker for a bit before burning all bridges.

throwaway290•2mo ago

Isn't this post basically service for attackers?

You take down C&C and phishing pages=great but maybe don't brag exactly what you did especially if the people are out to do it again but better?

some_random•2mo ago

Exposing a .git folder is a common error that people other than threat actors make, making a public post about it at least can help ordinary developers in addition to TAs making this mistake. If you find this disclosure frustrating, take a look at what threat intel/AV/EDR/etc companies post on their blogs.

throwaway290•2mo ago

yeah look at like Krebs, he actually tries to track down the criminals and not make their job easy by posting their mistakes halfway during the operation...

ekjhgkejhgk•2mo ago

Sounds like they got off easy.

spirovskib•2mo ago

They probably did. But it's a volunteer effort, we all contrinbute as much each individual's time permits.

some_random•2mo ago

Truth is that threat actors usually do. Much of the time they live in jurisdictions that don't care about cybercrime, and even if they don't actually cooperating with authorities is usually difficult.

ArcHound•2mo ago

It is great that they got taken down. From my experience, these sites are usually parasites on misconfigured Wordpresseses.

We're you able to get the phishing data so that you can help the victims? Is it a good idea to try and do so?

Also, can you please share some bits of the phishing kit for easier detection?

Thank you for your efforts!

spirovskib•2mo ago

Thanks for the kind words. We discussed whether to pull the data. We didn't for two reasons: 1. It's not trivial to process that data safely, and all the people in the server are volunteers that pitch in as much as they can. It won't be fair to burden them more. 2. The bots were posting to what appeared to be private or moderated channels. We didn't find an easy way in. Maybe there was a way in, but see item 1 above. So we went with "nuke it from orbit"

ArcHound•2mo ago

Yeah, that's the problem, processing the data safely. I wouldn't want to do that either without a lawyer covering my back.

CGamesPlay•2mo ago

What leads to the secret being stored in git's config file like that? None of my repositories have that, the remote URLs all just say "git@github.com:foo/bar.git".

aewens•2mo ago

The way Git computes diffs is by more or less storing all the source code in the .git directory as objects. At first glance it looks like a bunch of hashes, but tools can pull out source code from the objects tracked within the .git directory. Not least of which, the remote URL points to their username on GitHub and the author for commits can give you their email.

phyzome•2mo ago

I think you misread the question.

CGamesPlay•2mo ago

Not least of which, and even more so the URL had an auth secret in it. None of mine do, hence the question. I'm confused, because git has a credentials helper specifically designed to avoid storing secrets like that, or so I thought. So what tool is storing secrets in the git remote URL?

Yes, the git directory has all current and historical versions of the files packed into it, but that's not what the OP used to get information about the scammer.

phyzome•2mo ago

It's one of several ways to auth to the server. I guess they didn't want to use SSH. And if you use HTTPS instead, you're prompted for your username and password every time -- unless you pass a token.

xantronix•2mo ago

The URL you see in that fourth screenshot in the Imgur post is from using `git clone` on the the same URL, which was issued on GitHub.

CGamesPlay•2mo ago

How do you get Github to issue such URLs? No repository lists URLs in that format on Github for me.

KomoD•2mo ago

In reality, it wasn't the attacker's incompetence, it was the hosting provider's fault (which is a "Serverless app platform" they use to deploy their phishing pages)

When you deploy a simple page with them it exposes .git/CONFIG and the x-access-token that grants access to the repository.

wink•2mo ago

Lacking details, but people don't generally rsync a checkout of a git repo (including a .git folder) to their webspace, so you're right if the hoster did that, I find it more likely the people did that.

On the other hand just blacklisting .git/* is not great, maybe I want to publish something on that path, just like any other filename. It's prone to lead to false positives.

JakeStone•2mo ago

I agree with never deploying a .git folder to prod.

Part of our deployment script for sites has something like:

  git clone -d 1 -b $BRANCH https://blahblah.tld/project
  rm -rf .git*

So no .git directory, .gitignore, and so on.

pabs3•2mo ago

Another option for that might be `git archive | tar -C /path/to/dir -xf-`

Former Tumblr Head Jeff D'Onofrio Steps in as Acting CEO at the Washington Post

Bounded Flexible Arrays in C

The Invisible Labor Force Powering AI

Reading Recursion via Pascal

Show HN: I made a website that finds patterns on your spreadsheet

Jokes on You AI: Turning the Tables – LLMs for Learning

You don't need RAG in 2026

WatchLLM – Cost kill switch for AI agents (with loop detection)

I turned myself into an AI-generated deathbot – here's what I found

Management style doesn't predict survival

One Generation Runs the Country. The Next Cashed in on Crypto

"I Was Wrong": Why the Civil War Is Running Late [video][2h21m]

Show HN: A sandboxed execution environment for AI agents via WASM

Wine-Staging 11.2 Brings More Patches to Help Adobe Photoshop on Linux

The Nature of the Beast

From Prediction to Compilation: A Manifesto for Intrinsically Reliable AI

Show HN: Curated list of 1000 open source alternatives to proprietary software

AI's Real Problem Is Illegitimacy, Not Hallucination

'I fell into it': ex-criminal hackers urge UK pupils to use web skills for good

Why 175-Year-Old Glassmaker Corning Is Suddenly an AI Superstar

Keeping WSL Alive

Unlocking core memories with GoldSrc engine and CS 1.6 (2025)

Gtrace an advanced network path analysis tool

America does not trust Putin or Trump

Let's Do Music in Linux [video]

"Nothing" is the secret to structuring your work

AI Makes the Easy Part Easier and the Hard Part Harder

Show HN: Fine-tuned Qwen2.5-7B on 100 films for probabilistic story graphs

A failed wantrepreneur's view on common startup advice

Show HN: BestClaw Simple OpenClaw/MoltBot for non tech people

Former Tumblr Head Jeff D'Onofrio Steps in as Acting CEO at the Washington Post

Bounded Flexible Arrays in C

The Invisible Labor Force Powering AI

Reading Recursion via Pascal

Show HN: I made a website that finds patterns on your spreadsheet

Jokes on You AI: Turning the Tables – LLMs for Learning

You don't need RAG in 2026

WatchLLM – Cost kill switch for AI agents (with loop detection)

I turned myself into an AI-generated deathbot – here's what I found

Management style doesn't predict survival

One Generation Runs the Country. The Next Cashed in on Crypto

"I Was Wrong": Why the Civil War Is Running Late [video][2h21m]

Show HN: A sandboxed execution environment for AI agents via WASM

Wine-Staging 11.2 Brings More Patches to Help Adobe Photoshop on Linux

The Nature of the Beast

From Prediction to Compilation: A Manifesto for Intrinsically Reliable AI

Show HN: Curated list of 1000 open source alternatives to proprietary software

AI's Real Problem Is Illegitimacy, Not Hallucination

'I fell into it': ex-criminal hackers urge UK pupils to use web skills for good

Why 175-Year-Old Glassmaker Corning Is Suddenly an AI Superstar

Keeping WSL Alive

Unlocking core memories with GoldSrc engine and CS 1.6 (2025)

Gtrace an advanced network path analysis tool

America does not trust Putin or Trump

Let's Do Music in Linux [video]

"Nothing" is the secret to structuring your work

AI Makes the Easy Part Easier and the Hard Part Harder

Show HN: Fine-tuned Qwen2.5-7B on 100 films for probabilistic story graphs

A failed wantrepreneur's view on common startup advice

Show HN: BestClaw Simple OpenClaw/MoltBot for non tech people

An exposed .git folder let us dox a phishing campaign

Comments