ForceMemo Hijacks GitHub Accounts, Backdoors Hundreds Of Python Repositories

The StepSecurity threat intelligence team has identified an active cybersecurity campaign dubbed “ForceMemo.” This attack compromises GitHub developer accounts to backdoor hundreds of Python repositories secretly.

Starting on March 8, 2026, threat actors have been injecting malicious code into popular Python projects, including machine learning research, Django applications, and PyPI packages. Anyone who clones a compromised repository or installs it using pip risks executing the hidden malware.​

The root cause of these account takeovers is the GlassWorm malware. Developers were initially infected through malicious VS Code and Cursor extensions, which silently harvested their GitHub authentication tokens.

Once the attackers acquired these credentials, they gained full access to the victims’ repositories. Evidence shows that when an account falls victim to this credential theft, every Python repository under that account gets infected simultaneously.

Stealthy Injection and Blockchain Command

Instead of creating visible pull requests, the attackers use a highly stealthy injection method. They take the latest legitimate commit on a repository’s default branch, append heavily obfuscated Python code to files like setup.py or main.py, and force-push the changes.

This technique preserves the original author’s name and commit message, making the repository appear untouched at first glance. However, the committer date changes, and the committer email is frequently set to “null,” which serves as a unique fingerprint for this campaign.​

Once a victim executes the poisoned Python file, the malware initiates a complex infection chain. It first checks the system’s locale and timezone to ensure the victim is not located in Russia, a common evasion tactic used by Eastern European cybercriminals.

If the system is outside the restricted region, the malware reaches out to the Solana blockchain rather than a traditional command-and-control server.

Network monitoring tools like StepSecurity Harden-Runner, which specialize in CI/CD environment security, have successfully observed this behavior in isolated environments by capturing abnormal outbound connections to Solana endpoints and payload servers.​

Indicators Of Compromise

According to Step Security research, security teams and developers should actively monitor their environments for signs of the ForceMemo campaign.

The attackers rely on a distinct set of network and host-based indicators. Below is a summary of the critical technical data associated with this threat.

To ensure project safety, developers who frequently install Python packages directly from GitHub should review their local repositories.

Checking the commit history for discrepancies between author and committer dates, or searching local files for the malware’s distinct variable name, can help identify compromised code before it executes.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.