Island finds MicrosoftSystem64 campaign in GitHub repos

Island identified a MicrosoftSystem64-linked software supply chain campaign spanning at least 88 public GitHub repositories. One repository tied to the operation surfaced in recommendations from both ChatGPT and Google AI Overview.

The campaign delivered a cross-platform remote access trojan through malicious npm dependency chains, while the repositories were presented as functional, credible software projects.

The findings suggest a shift in how attackers can abuse software discovery tools used by developers and coding agents. Rather than relying on obviously malicious repositories or directly compromising an artificial intelligence system, the operation appears to have focused on making code look legitimate enough to be recommended and installed.

Island traced the campaign to the MicrosoftSystem64 malware cluster, which is designed to execute commands, access files, maintain persistence and deploy additional payloads on Windows, macOS and Linux systems. The malware family takes its name from a persistence identity used across those operating systems.

A key part of the investigation centred on a GitHub repository called shopify-mcp under the Cesarjoquin account. Island tested whether the project would appear in ordinary software searches by asking ChatGPT for MCP packages that could help manage a Shopify store and separately running a Google search for a Shopify MCP server for Claude Desktop.

In both cases, the repository appeared without its name or any threat context being supplied. On its face, the project looked plausible because it included detailed documentation and working Shopify-related functions. But one of its dependencies had been linked to the MicrosoftSystem64 delivery chain.

How it worked

The campaign did not depend on empty or obviously fraudulent repositories. In several cases, attackers copied genuine open-source projects, kept their original functions intact and then modified them so the malicious dependency appeared to serve a reasonable technical purpose.

In the Shopify example, the code was altered to add a Redis connection manager and token cache tied into Shopify's OAuth flow. That made the suspicious dependency look relevant to the application because it handled the storage and retrieval of access tokens.

The top-level dependency shifted over time from ioredis-xyz to oscar-redis and later oracle-redis, while the repository, documentation and visible application logic remained in place. That meant a repository could continue to look trustworthy even as the package carrying the malware changed.

The researchers said this made the repository itself the enduring distribution asset, while the npm package name could be replaced as needed. For defenders, that weakens the value of relying on a single package name as an indicator of compromise.

Credibility signals

The report also described what it called manufactured legitimacy around the affected GitHub accounts. One account linked to the campaign appeared established, with an older profile date, hundreds of contributions and repositories showing large numbers of forks.

Yet the same account had created all 25 of its public repositories within three days. Some appeared to contain years of development history, but researchers found matching upstream projects whose commit histories had been imported and, in some cases, reattributed to the campaign-linked identity.

Elsewhere, development history appears to have been generated directly. One repository contained a script that programmatically created roughly 57 staged Git commits. In another case, 10 apparent development milestones were committed within 11 seconds.

Those techniques were paired with signs of synthetic popularity. Across the 88 public repositories linked to the campaign, Island counted 9,881 stars and 65,681 forks. Across seven AI- and MCP-related repositories, 664 of 673 consecutive fork intervals fell between 179 and 182 seconds, suggesting an automated process.

Fork ownership also showed unusual concentration. In one repository, 1,231 of 1,238 fork objects returned by GitHub were owned by just 22 organisation accounts, with 21 organisations holding exactly 56 forks each and one holding 55.

Broader pattern

The campaign adds to a growing body of research on software supply chain attacks that target developer workflows rather than end users directly. Earlier reporting by other security groups documented malicious npm packages and dependency chains associated with the same malware family, but Island said the newer findings show a broader operation built around repository presentation, history and adoption signals.

Many of the identified repositories were themed around AI agents, finance, trading, healthcare and developer tooling. Several were positioned around MCP servers and software intended for use with large language model assistants.

For security teams, the concern is that AI-assisted software discovery shortens the path between searching for a tool and installing it. A developer, or an AI coding agent acting on a developer's behalf, may treat documentation, apparent maintenance history, test files and visible adoption as signs that a repository is safe to use.

Island said it could not determine which signal caused the Shopify repository to appear in ChatGPT and Google AI Overview, or whether the campaign had been designed specifically to influence large language model recommendations. But the evidence showed that the repositories had accumulated the same signals that make software appear established and widely used.

Ofek Ronen, Security researcher at Island, said: "The attacker did not need to compromise the AI. It needed to build software the AI could reasonably recommend."