Loading story…
Researchers reported that the Drokbk malware family uses GitHub as a dead drop resolver to obtain command-and-control infrastructure, allowing infected systems to retrieve operational data from a trusted public platform instead of contacting attacker-controlled servers directly. The technique helps the malware blend into normal network traffic and complicates blocking and attribution, because defenders may see connections to GitHub rather than an obvious malicious domain.
Coverage from Sophos and Secureworks highlights the same campaign behavior: Drokbk relies on content hosted on GitHub to resolve or update the next-stage destination used for attacker communications. The approach reflects a broader trend of threat actors abusing legitimate cloud and developer services for resilience and stealth, underscoring the need for defenders to inspect outbound traffic patterns, monitor unusual access to public repositories, and correlate GitHub activity with endpoint indicators of compromise.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Sophos and Secureworks published reporting describing Drokbk malware using GitHub as a dead drop resolver technique for command-and-control related activity. The references do not provide an earlier event date, so the publication date is used as the best estimate.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported active **software supply chain attacks** in which legitimate GitHub accounts and repositories were compromised and then used to distribute malware to developers. In one case, the verified **dev-protocol** GitHub organization was hijacked and repurposed to host polished **Polymarket** trading-bot repositories that secretly pulled typosquatted npm dependencies. Running the project exfiltrated `.env` contents including wallet private keys to attacker-controlled infrastructure, performed host fingerprinting, and modified firewall settings to expose SSH access; victims were advised to rotate wallet and API secrets and inspect `~/.ssh/authorized_keys` for persistence. A separate but related GitHub-focused campaign, dubbed **ForceMemo**, involved takeover of developer accounts and force-pushes to hundreds of Python repositories so that malicious code was appended to files such as `setup.py`, `main.py`, and `app.py` while preserving original commit metadata. Anyone installing directly from those repos could trigger the payload, and the activity affected projects ranging from Django applications to ML and Streamlit code. A report on malicious npm packages posing as a Roblox *Solara* executor was excluded because it describes a different npm ecosystem campaign centered on **Cipher stealer**, not the GitHub account and repository hijacks used in the other incidents.
Jun 29, 2026
The Astaroth banking trojan has resurfaced with a new campaign that leverages GitHub repositories to host its malware configurations, significantly enhancing its resilience against takedown efforts. Security researchers from McAfee and other organizations have observed that, rather than relying solely on traditional command-and-control (C2) servers, the attackers are now using GitHub’s trusted infrastructure to store and distribute configuration files and redirection instructions. This approach allows the threat actors to dynamically update the trojan’s settings and switch to new C2 servers as needed, making it much more difficult for law enforcement and security teams to disrupt the campaign. The attack chain typically begins with phishing emails that lure victims into downloading a ZIP file, which contains a malicious LNK shortcut. When executed, this shortcut launches obfuscated JavaScript via mshta.exe, which then downloads several files, including an AutoIt script, the AutoIt interpreter, an encrypted payload, and an encrypted configuration file. The AutoIt script is responsible for building and executing shellcode in memory, which then loads a Delphi DLL. This DLL decrypts and injects the final Astaroth payload into a new RegSvc.exe process, allowing the malware to operate stealthily on the infected system. Astaroth is known for its fileless operation, anti-analysis techniques, and its ability to avoid US and English locales, focusing its attacks primarily on South American countries such as Brazil, Mexico, Uruguay, Argentina, Paraguay, Chile, Bolivia, Peru, Ecuador, Colombia, Venezuela, and Panama, with some activity also noted in Portugal and Italy. The trojan monitors foreground windows for banking and cryptocurrency sites, and when detected, it hooks the keyboard to steal credentials via keylogging. Stolen data is exfiltrated to the attackers’ infrastructure using the Ngrok reverse proxy, further complicating efforts to trace or block the communications. Persistence is achieved by dropping a LNK file in the startup folder, ensuring the malicious AutoIt script runs on system reboot. Experts warn that the use of GitHub’s high-availability and trusted reputation not only makes takedowns more challenging but also raises concerns about the potential for the campaign to expand beyond its current regional focus. The campaign’s sophistication is further underscored by its use of public repositories for configuration management, allowing for rapid adaptation and continued operation even as individual C2 nodes are neutralized. Security professionals highlight that this method of infrastructure abuse is part of a broader trend, with adversaries increasingly exploiting legitimate cloud and code-hosting platforms to evade detection and maintain operational continuity. The campaign’s reliance on phishing as the initial infection vector underscores the ongoing importance of user awareness and email security controls. The technical complexity of the infection chain, including multiple layers of obfuscation and in-memory execution, demonstrates the evolving tactics of financially motivated cybercriminals. The campaign’s focus on banking credentials and cryptocurrency accounts indicates a clear intent to monetize stolen information. The use of AutoIt scripting and the ability to update configurations on the fly make this variant of Astaroth particularly challenging to defend against. Security experts recommend heightened vigilance, robust endpoint protection, and monitoring for suspicious use of legitimate platforms like GitHub in enterprise environments. The campaign serves as a reminder of the persistent threat posed by banking trojans and the need for adaptive, multi-layered defense strategies.
Jun 29, 2026
Researchers reported a large-scale GitHub malware distribution campaign that has operated since March 2025, using repositories masquerading as cracked browser extensions, gaming cheats, developer tools, and, more recently, fake AI skills and MCP servers. The activity has been tied to a Vietnamese-speaking operator and spans more than 47 GitHub accounts and 600 malicious ZIP archives, with some accounts believed to have been compromised rather than created solely for abuse. The campaign’s social-engineering lures target both general users and developers seeking unofficial software, automation tools, or AI-related components. The repositories deliver a multi-stage **LuaJIT** loader chain that ultimately installs the **StealC** information stealer. Payloads are fetched from GitHub “dead drop” repositories, then decrypted through layered obfuscation including hex, XOR, `base64url`, and **AES-ECB** before process hollowing is used for injection. Researchers said the malware also resolves command-and-control infrastructure through **Polygon Mainnet** smart contracts, allowing operators to rotate C2 URLs or IPs without changing deployed binaries; telemetry linked the activity to detections such as BitDefender `Gen:Heur.FakeGit.1` and ESET’s `Lua/Agent` family, while infrastructure usage heavily overlapped with bulletproof hosting providers including **ASN 207957 (Serv.host Group Ltd)**.
Jul 22, 2026