Loading story…
Researchers at Cyderes reported a malware campaign abusing GitHub user attachment links hosted on GitHub’s CDN to distribute ZIP archives that launch a five-stage infection chain. The archives deliver a novel loader, Direct-Sys Loader, and an infostealer, CGrabber Stealer, using signed binary sideloading, ChaCha20-based decryption, reflective loading, direct syscalls, and APC-based process injection into legitimate Microsoft-signed processes including Launcher_x64.exe and Dllhost.exe.
CGrabber Stealer was observed performing repeated anti-sandbox and anti-analysis checks, skipping systems configured for CIS locales, and contacting a remote command-and-control server before stealing data from browsers, cryptocurrency wallets, browser extensions, VPN clients, password managers, messaging applications, and other software. The stolen information is packaged into ZIP archives for exfiltration, and researchers said shared encryption routines and evasion logic indicate the loader and stealer were likely built by the same author; defenders were urged to watch for DLL sideloading, syscall stubs, suspicious outbound POST traffic, and attempts to patch AMSI and ETW.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
SC Media covered Cyderes' findings on the campaign distributing CGrabber Stealer via GitHub user attachment links. The article summarized the malware’s data theft targets, including browsers, crypto wallets, VPNs, password managers, messaging apps, and other applications.
Cyderes published technical details linking the loader and stealer to a likely common author based on shared encryption routines and anti-analysis logic. The report also recommended monitoring for syscall stubs, DLL sideloading, suspicious outbound POST traffic, and AMSI and ETW patching activity.
Cyderes reported a malware campaign abusing GitHub user attachment links on GitHub’s CDN to deliver ZIP archives containing the novel Direct-Sys Loader and CGrabber Stealer. The researchers documented a five-stage infection chain using signed binary sideloading, anti-analysis checks, ChaCha20-based decryption, reflective loading, direct syscalls, and APC-based process injection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 93 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a large-scale GitHub malware distribution campaign that has operated since March 2025, using repositories masquerading as cracked browser extensions, gaming cheats, developer tools, and, more recently, fake AI skills and MCP servers. The activity has been tied to a Vietnamese-speaking operator and spans more than 47 GitHub accounts and 600 malicious ZIP archives, with some accounts believed to have been compromised rather than created solely for abuse. The campaign’s social-engineering lures target both general users and developers seeking unofficial software, automation tools, or AI-related components. The repositories deliver a multi-stage **LuaJIT** loader chain that ultimately installs the **StealC** information stealer. Payloads are fetched from GitHub “dead drop” repositories, then decrypted through layered obfuscation including hex, XOR, `base64url`, and **AES-ECB** before process hollowing is used for injection. Researchers said the malware also resolves command-and-control infrastructure through **Polygon Mainnet** smart contracts, allowing operators to rotate C2 URLs or IPs without changing deployed binaries; telemetry linked the activity to detections such as BitDefender `Gen:Heur.FakeGit.1` and ESET’s `Lua/Agent` family, while infrastructure usage heavily overlapped with bulletproof hosting providers including **ASN 207957 (Serv.host Group Ltd)**.
Jul 22, 2026
Threat actors abused GitHub to distribute malware by cloning legitimate repositories, impersonating trusted open-source projects, and poisoning search results to steer victims to trojanized downloads. One campaign spoofed the **AIMMY** game-cheat project through a cloned repository and the lookalike site `aimmy.app`, while also exploiting GitHub's issue-draft upload behavior to host malicious files on the original benign repository via direct links that appeared trustworthy. The delivered packages included files such as `Aimmy.bat`, `AimmyLauncher.exe`, `lua51.dll`, and supporting data, with the malware implemented through obfuscated **LuaJIT** code. Follow-on analysis tied similar GitHub repo poisoning activity to **SmartLoader**, which used trojanized `lua51.dll` components and heavily obfuscated Lua payloads to deploy **StealC** infostealer. The malware performed anti-debugging and anti-tamper checks, captured screenshots, verified connectivity and geolocation, and fetched additional payloads from attacker-controlled GitHub repositories. Researchers found it also used the **EtherHiding** technique, querying the Polygon PoS blockchain for dynamically updated command-and-control data, before exfiltrating browser credentials, cookies, cryptocurrency wallet information, and email data to attacker infrastructure including `213.176.72[.]200`.
Aug 15, 2026
Researchers exposed an active **LegionLoader** malware campaign, also tracked as **Satacom**, **CurlyGate**, and **RobotDropper**, that uses drive-by-download lures and short-lived redirect pages to push password-protected archives from file-sharing services such as **Mega**. The archives contain MSI installers that unpack and sideload a malicious `obs.dll`, which decrypts shellcode and a second-stage executable before using **process hollowing** into `explorer.exe` to continue execution. Analysis found heavy use of `.monster` domains, hard-coded command-and-control infrastructure, and tooling intended to download additional payloads, although some observed C2 servers were inactive during review. The activity aligns with earlier Satacom operations that abused malicious or compromised websites and fake download buttons to distribute malware disguised as free or cracked software. In prior campaigns, the loader fetched follow-on payloads through DNS TXT lookups and PowerShell, then installed a fake Chromium-based **"Google Drive"** extension that targeted cryptocurrency users by stealing wallet data, manipulating transactions, bypassing 2FA, and suppressing transaction emails across Gmail, Hotmail, and Yahoo. The newer findings indicate the operators continue to rely on staged delivery, stealthy execution, and flexible payload retrieval, while defenders have been provided with hashes, URLs, file paths, registry artifacts, and **YARA** rules to detect the campaign.
Aug 15, 2026