Attacks Blog

Mockito docs hijacked

Some attacks are stupidly low tech. Mockito, a popular open source package contained a malicious link in their Github Docs.

Sep 30, 2025 • 3 min read

Simon Wijckmans Founder & CEO

Table of Contents

TL;DR: Mockito wiki three-year malicious installer link

Just a wiki edit: Not every supply chain attack needs a zero-day. The Mockito hijack was a wiki edit, no PR, no review, and it survived on the docs homepage for over three years.
Three years live: The malicious yip[.]su/2F5rd4 shortlink lived on Mockito's wiki install section for over three years before removal, flagged as malicious on VirusTotal. cside monitors the URLs your users actually reach from third-party surfaces, not just the ones your PR pipeline approved.
Lock the wiki: If your open-source project keeps installer instructions in a Wiki, lock editing to maintainers today. If you cannot lock it, move docs into /docs behind PR review before someone else's Java dev clicks a Windows installer that is not yours.

Short on time? See cside's in-browser Magecart and skimmer blocking. It covers everything below in one deployment.

A malicious installation link was found on a popular open source project github wiki, it pointed to a third party URL (https://yip[.]su/2F5rd4) flagged by VirusTotal. If your project uses Github wikis lock them down and restrict access.

What happened

While reviewing documentation for mockito (Most popular Mocking framework for unit tests written in Java) someone noticed its Wikis installation section linked users to shortened url (https://yip[.]su/2F5rd4). The link was unrelated to the project and it is flagged as malicious on VirusTotal. The link lived on the Wiki's home page for over 3 years before it was removed.

Issue discussion: https://github.com/mockito/mockito/issues/3721

Wiki diff showing the insertion/removal:https://github.com/mockito/mockito/wiki/Home/_compare/7303a66959d7823864637d280a92b2a51b68c467...eb1df9c48fd3529bed997a81b4a2100e8c562fcd

Malicious short link: https://yip[.]su/2F5rd4

VirusTotal report: https://www.virustotal.com/gui/url/d05eafed450060b4cf8b044bcd7f74f0e1131d49cd2ea76b84de934e55390233

Evidence

The Wiki diff below shows injected html that renders download buttons and includes a Windows link to the malicious short URL:

[Download installer](http://goo-gl[.]me/kj2PI)
## Installation

<a href="https://yip[.]su/2F5rd4"><img src="https://github[.]com/aidenlab/JuiceboxLegacy/wiki/images/winlogo.png" width=100 align="middle"/></a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="https://yip[.]su/2F5rd4">Mockito for Windows</a>

<a href="https://github[.]com/mockito/mockito/releases"><img src="https://github[.]com/aidenlab/JuiceboxLegacy/wiki/images/maclogo.png" width=100 align="middle"/></a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="https://github[.]com/mockito/mockito/releases">Mockito for Mac</a>

<a href="https://github[.]com/mockito/mockito/releases"><img src="https://www.rvmis[.]com/vendor/Tux.svg.png" width=100 align="middle"/></a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="https://github[.]com/mockito/mockito/releases">Mockito for Linux</a>

Rendered view: https://github.com/mockito/mockito/wiki/Home/_compare/7303a66959d7823864637d280a92b2a51b68c467...eb1df9c48fd3529bed997a81b4a2100e8c562fcd?short_path=355883c

Screenshot of the hijacked Mockito documentation where the Windows button links to a malicious URL — Screenshot of docs

The Windows button resolves to https://yip[.]su/2F5rd4.

Other popular projects can also be affected. This is not an isolated incident, any popular repo with an open or wiki is vulnerable to this attack method.

Why

Github Wikis are separate from code repo and with their own permissions on open public project and changes often bypass PR/code review process, so anyone can add malicious link and can be unnoticed and indexed by search.

What you can do to protect your Open Source project

disable or restrict Wiki editing to select collaborators only
move installation docs into /docs (or README) and require PR reviews

Takeaway

Docs are part of your project, treat them as actual code and follow the same code/review process.

Founder & CEO Simon Wijckmans

Founder and CEO of cside. Previously a product manager on Cloudflare Page Shield (now Cloudflare Client-Side Security). Co-chair of the W3C Anti-Fraud Community Group and a Forbes 30 Under 30 honoree. Building accessible security against client-side attacks, web security is not an enterprise-only problem.

Back to top

Don't just take our word for it, ask AI

Monitor and Secure Your Third-Party Scripts

Gain full visibility and control over every script delivered to your users to enhance site security and performance.

Book a demo

Start for free

Start free, or try Business with a 14-day trial.

cside dashboard interface showing script monitoring and security analytics

What is a BIN Attack? How to Detect and Stop Automated Card Testing

A BIN attack tests thousands of stolen or generated card numbers against your checkout. Detect the browser-layer signature and stop it before it costs you.

How to Detect Anthropic Computer Use on Your Website

Anthropic's Computer Use agent controls a real browser to complete tasks. Detect the signature at the browser layer before the agent transacts on your site.

What is formjacking? How it works and how to detect it

Formjacking injects malicious JavaScript into checkout pages to steal card data as it is typed, invisible to WAFs and CSPs. Here is how to detect it.

Inside a Live, Real-Time Google Credential-Phishing Kit: Fake CAPTCHA, Blob URLs and Encrypted WebSockets

A technical investigation of a live Google credential-phishing kit using fake CAPTCHA, blob URLs, remote-browser streaming and encrypted WebSockets.

Cookie Theft and Session Hijacking: How Attackers Steal Sessions and How to Stop Them

Cookie theft is when an attacker captures a session token from a logged-in user and replays it to impersonate them. No password needed, no MFA prompt. Here is how the attack works and how to stop it.

Homoglyph attacks: how аpple.com fools users and how to detect the substitution

Homoglyph attacks in 2026: аpple.com is not apple.com (and how to actually detect the difference)

Homoglyph attacks use visually identical Unicode characters to register lookalike domains for phishing and script injection. Here is how they work, why browsers stopped protecting you, and what actually detects them.

TLS fingerprinting: what the ClientHello reveals about the client library

TLS fingerprinting in 2026: what the ClientHello reveals (and where the signal fails)

TLS fingerprinting identifies the client library from the ClientHello handshake, before a single byte of HTTP is decrypted. Here is what it catches, what it misses, and where it belongs in a full detection stack.

Credential Harvesting: How Attackers Steal Passwords in 2026

Credential harvesting has moved from bulk phishing to session cookie theft, Evilginx style MFA bypass, and third party script injection at login. Here is how detection actually works.

New Account Fraud: What It Is, the Main Types, and How Detection Works

New account fraud (NAF) is fraud committed using a newly opened account. It comes in three forms, synthetic identity fraud, genuine identity manipulation, and fake account creation, each exploiting a different gap in standard registration controls.

What Is Formjacking? How the Attack Works and How to Stop It

Formjacking is a client-side attack that injects JavaScript to capture payment and login data as users type. Learn how the attack works, why traditional tools miss it, and how to detect it.