Git Branch Switch Trap Targets Credentials in Fake EdTech Deal

The owner of a U.S. web development company has disclosed that he was targeted in a targeted attack disguised as a development project in the education technology sector. The attacker apparently planted malicious code in a Git post-checkout hook in an attempt to steal credentials. The technique abuses developers’ routine clone and branch-switching operations, prompting warnings across the industry.

According to reporting by frankwiles on frankwiles.com via Lobsters, the incident has been published as a first-person account. He is the founder of REVSYS and is known for his involvement with the Django Steering Council and the Python Software Foundation. He says his position, with access to numerous client environments and privileges on GitHub, is behind why he was chosen as a target.

Someone targeted me in an attempt to run arbitrary code on my laptop.

He states upfront that he was targeted for arbitrary code execution. He then explains the timeline of the attack and the specific trap in detail.

Contact Posing as an EdTech Project

The initial contact was an inquiry about web application development in the education technology field. His company handles contract development in this field and, even during busy periods, responds to such inquiries as potential future work. To schedule a call, he sent the other party a scheduling link.

The other party asked him to review a project outline in advance and sign a non-disclosure agreement. This is standard procedure in contract development negotiations, and nothing seemed suspicious at this stage. The other party then shared a Dropbox folder presenting requirements in several Markdown documents.

The documents described a minimum viable product, while rough in detail, they were well presented. When he asked for the NDA form because he could not find it, the other party replied that it was in a branch. He was instructed to switch to the branch, fill it out, and return it before the meeting.

Those instructions were a trap combining a Git branch-switching operation with hook execution. At first, he had overlooked that the shared material contained Git repository metadata. The exchange over the location of the NDA led to discovery of the trap.

How the Trap Was Set in the NDA Branch

The other party specified switching to a branch named NDA. In Git, a post-checkout hook can run automatically when switching branches. The attacker exploited this behavior to link malicious processing to the branch switch.

He checked the hooks directory inside the metadata and noticed something wrong. In a location that normally contains only templates, there was an executable post-checkout hook. Few workplaces use post-checkout hooks routinely, which itself was unnatural.

He opened the contents carefully and confirmed it involved communication with an external party. It was configured to fetch a binary matching the execution environment via an external command-and-control application. After downloading it, the flow granted execution permission, launched it, and then deleted itself to erase traces.

This type of setup can be repurposed to collect credentials and secrets stored on a developer’s machine. GitHub accounts and connection details for client environments were likely targets. He describes it as an attempted targeted credential theft.

How the Unexecuted Attack Chain Worked

The attack chain was designed to start with the branch switch as the trigger. The moment the user switched to the NDA branch, the hook would launch a malicious fetch process. While the user believed they were proceeding with NDA paperwork, their machine would communicate externally in the background.

An application running on Vercel was reportedly used as the external command-and-control infrastructure. According to his checks, it served to distribute binaries tailored to the user’s OS. Deleting itself after execution can be seen as an attempt to delay detection.

Fortunately, he detected the hook before switching. As a result, the malicious binary was never executed on his machine. He reported the case to the security teams at Dropbox and Vercel and requested that the abused assets be taken down.

It was also found that the attacker had impersonated the owner of a real development company. The person whose name was used had nothing to do with the attack and was used to bolster credibility. The combination of impersonation with legitimate business procedures is the hallmark of this case.

In development work, cloning Git repositories and switching branches are everyday operations. Without checks, hooks could run unintentionally. He urges the utmost caution in managing credentials.

Defenses and Operations Needed in Development Work

First and foremost, it is important not to handle repositories of unknown origin carelessly. Particular caution is needed when shared folders or archives contain Git metadata. An effective procedure is to avoid switching branches immediately after cloning and to check the structure and history first.

Specifically, check for executable files under .git/hooks. If there is anything beyond templates, move it to an isolated environment before opening it. Inspect hooks, configurations, and the sources of external references, and check for suspicious destinations.

Cloning and extraction should ideally be done as a low-privilege user or in a virtual environment. It is also important to separate credentials and signing keys so they are not kept on the same machine or in the same user environment. Hold off on running any acquired files until you understand their contents and have identified where they communicate.

As for moves around testing infrastructure for development environments, there is also GNOME OS Test Center, Inspired by Apple TestFlight. The idea of controlling testing and distribution processes also applies to countering insertions like this one. In contract development, standardizing verification procedures forms the basis of defense.

For organizations, verification steps need to be added to client-handling procedures. For first-time transactions, verify the other party’s identity and track record through a separate channel. Limit how contracts are received and spell out in writing how to handle any executable attachments.

Challenges the Supply Chain Attack Poses for

the Industry

This case is not an attack exploiting a specific vulnerability. It is a hybrid of social engineering and supply-chain tactics that exploits trust in business negotiations and developer habits. The target was not large-scale infrastructure, but a single privilege holder.

Similar techniques could be applied to other hooks or dependency-resolution processes. Legitimate procedures such as document sharing and scheduling were used as cover for the attack. Information asymmetry between clients and contractors creates room for exploitation.

Across the industry, expanded reuse and automation are putting pressure on verification work. The faster external artifacts are brought in, the harder it becomes to detect insertions. Operations that rely solely on individual vigilance are approaching their limits.

Editorial Opinion

On the short-term impact. We see this case changing initial responses in contract development over the next three to six months. We assess that checks for hooks when receiving external repositories will spread. We see more companies reviewing how they handle Git metadata via shared folders. It seems likely that the platform operators that received reports will also strengthen abuse detection.

On the long-term view. In the one to three year range, we see separation of development environments becoming standard. We assess that performing cloning and extraction in isolated environments will become established practice. We see progress in introducing mechanisms to log dependency and hook execution. It seems likely that verifying a client’s identity through a separate channel will take root as a business practice.

Questions from the editors. The question is how far execution paths hidden in everyday operations can be mapped. Are there sufficient means to visualize automatic execution in branch switching and dependency resolution. Assuming a focus on privilege holders, how should organizational approval and monitoring be designed. How to enforce verification without sacrificing convenience is the question.

References

• “I got targeted: Trying to get your credentials via a git post-checkout hook”, by frankwiles.com by frankwiles — Lobsters, 2026-10-02T22:19:02.000Z (ARR)
• Source URL: https://frankwiles.com/posts/i-got-targeted/