Hackers Impersonate Linux Foundation Leader on Slack to Target Open Source Developers

Key Takeaways

• A sophisticated social engineering campaign is targeting open-source developers on Slack.
• Attackers impersonate a Linux Foundation leader to trick victims into installing malicious root certificates and malware.
• The multi-stage attack harvests credentials and, on macOS, deploys a binary providing remote control.
• The campaign exploits trust within open-source communities, using seemingly legitimate platforms like Google Sites.

Sophisticated Social Engineering Targets Open Source Developers via Slack Impersonation

Open source developers are confronting an increasingly refined threat that bypasses complex technical exploits, instead leveraging the fundamental vector of trust. A coordinated social engineering operation is actively preying on developers within Slack workspaces, with threat actors masquerading as a prominent Linux Foundation community leader to induce victims into downloading malicious software.

This campaign first came to light on April 7, 2026, when Christopher “CRob” Robinson, Chief Technology Officer and Chief Security Architect at the Open Source Security Foundation (OpenSSF), issued a high-severity advisory via the OpenSSF Siren mailing list. The advisory detailed the ongoing attack, which primarily focused on the Slack environment of the TODO Group, a Linux Foundation working group dedicated to open source program office (OSPO) practitioners, as well as other affiliated open source communities.

The attackers meticulously constructed a fake online persona of a well-known Linux Foundation figure. This fabricated identity was then used to send direct messages containing a phishing link. Crucially, this link was hosted on Google Sites, a platform that many developers consider trustworthy and legitimate. The link itself was carefully designed to appear authentic, making it exceptionally difficult for even security-conscious developers to detect the deception.

Analysts from Socket.dev, including a Socket engineer, were among the first to investigate and document the technical specifics of the attack. Their findings confirmed that this was not a rudimentary phishing attempt but a calculated, multi-stage operation engineered to exploit the inherent trust prevalent within tightly-knit open source communities.

The attacker’s lure was precisely tailored. Posing as the Linux Foundation leader, the threat actor pitched an exclusive, private AI tool purportedly capable of analyzing open source project dynamics and predicting which code contributions would be merged even before a reviewer examined them. The message underscored the tool’s exclusivity, stating that the team was “only sharing this with a few people for now.” Alongside the phishing link, the attacker provided a fake email address and an access key to lend credibility to the fraudulent workflow.

Upon clicking the link, victims were led through a deceptive authentication process designed to harvest their email address and a verification code. Following the theft of these credentials, the phishing site then prompted victims to install what it misleadingly termed a “Google certificate.” In reality, this was a malicious root certificate. Once installed, this certificate enabled the attacker to silently intercept encrypted web traffic between the victim’s device and any website they visited. This critical step set the stage for the most damaging phase of the attack, which subsequently diverged based on the victim’s operating system.

Inside the Infection Mechanism

The platform-specific nature of this attack highlights its sophisticated engineering. On macOS systems, after the malicious root certificate was installed, a script automatically downloaded and executed a binary named gapi from the remote IP address 2.26.97.61. The execution of this binary grants the attacker potential full control over the compromised device, encompassing abilities such as accessing files, stealing further credentials, and issuing additional commands remotely.

For Windows users, the attack prompted the installation of the malicious certificate via a standard browser trust dialog. Once accepted, this allowed for the same interception of encrypted traffic. Across both operating systems, the complete attack unfolded in four distinct stages: impersonation, phishing, credential harvesting, and malware delivery. Each stage built upon the preceding one, pushing deeper into the victim’s digital environment.

What You Should Do

• Verify Identities Out-of-Band: Never solely trust a Slack message based on a display name or profile photo. Always confirm unusual requests, especially those involving links or installations, through a separate, known communication channel (e.g., a phone call or an email to a verified address) before taking any action.
• Never Install Root Certificates from Untrusted Sources: Legitimate services will not ask you to install a root certificate via a chat message or email link. Treat any such prompt as highly suspicious unless explicitly directed by your organization’s IT team through official channels.
• Enable Multi-Factor Authentication (MFA): Implement MFA on all developer and collaboration accounts. While MFA cannot prevent impersonation, it significantly limits the potential damage if your credentials are compromised.
• Be Skeptical of Exclusive Offers: Be wary of messages promoting “exclusive” or “private” tools, especially those that promise advanced capabilities or early access, as these are common social engineering tactics.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.