Someone is using your cute firmware for a social engineering attack.

[caturine1312]

Someone stole your firmware and is using it in a scam repo alongside others. GitHub has been very slow when me and others have reported the same attack with other repos, in the past.
Maybe if you report it they'll react a bit quicker and I felt like it was the right thing to inform you of this.

https://github.com/maribethnational442/misspoppyrabbit

They link a fake release page, where they uploaded an archive containing malware and edited the README.md so that it specifically targets Win10/11 users, since that fits the attack scheme.

I downloaded it to a VM and took a quick look and checked the contents with VirusTotal.

Here are some screenshots:

[SebasPinto]

Huge thanks for this report. You took the time to spin up a VM, run the file through VirusTotal, take screenshots, and warn a small project you don't even use. That's the open-source community at its best, and I genuinely appreciate it.

Confirmed on my side: that repo is an unauthorized copy with a rewritten README pushing a fake Windows "installer" (src/Software_v3.5.zip). Miss Poppy Rabbit is ESP32 firmware, so there is no Windows installer, ever. The only official sources are this repo's Releases, the web installer and M5Burner.

I've already reported the repo to GitHub as malware and added a security notice to the README. If you still have the VirusTotal permalink, sharing it here would strengthen the case. I'll keep this issue pinned until the copy is taken down.

Thanks again, the rabbit owes you one. 🐰🌺

[caturine1312]

Huge thanks for this report. You took the time to spin up a VM, run the file through VirusTotal, take screenshots, and warn a small project you don't even use. That's the open-source community at its best, and I genuinely appreciate it.

Confirmed on my side: that repo is an unauthorized copy with a rewritten README pushing a fake Windows "installer" (src/Software_v3.5.zip). Miss Poppy Rabbit is ESP32 firmware, so there is no Windows installer, ever. The only official sources are this repo's Releases, the web installer and M5Burner.

I've already reported the repo to GitHub as malware and added a security notice to the README. If you still have the VirusTotal permalink, sharing it here would strengthen the case. I'll keep this issue pinned until the copy is taken down.

Thanks again, the rabbit owes you one. 🐰🌺

Oh it's really no big deal. I profited so much from open source firmwares and software. It's the least I can do and it really was a collective effort. You really gotta thank the person who made the discovery. Check out the "cardputer" Discord servers "scam aware firmware"-channel, if you feel like saying thanks to the person. :)

Sadly I already deleted the VM and don't have the time to set one up again, but GitHub checks again anyway. (If they react at all. They took WEEKS last time people reported a similar attack)
Say "hi" to misspoppyrabbit from me!

[caturine1312]

Also if you feel like helping you can report the two other repos the attacker uses or warn the original owners of the firmwares being misused for the scam.