Loading story…
A proof-of-concept Windows stealer was published showing how the GitHub REST API can be abused as a command-and-control and data-exfiltration channel by posting comments to a GitHub issue. The sample uses a GitHub personal access token and WinHTTP to send data to api.github.com, specifically the issue-comments endpoint, demonstrating how attacker traffic can blend with legitimate developer-platform activity.
The malware example collects host and network details from Windows systems, including hostname, operating system, processor, drive information, IP address, subnet, and MAC address, then transmits the data through GitHub issue comments. The author demonstrated the technique on Windows 10 and Windows 11 virtual machines and observed outbound traffic to GitHub API infrastructure, underscoring how trusted cloud services can be repurposed to hide malicious communications and exfiltration.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A blog post presented a Windows proof-of-concept stealer written in C that abuses the GitHub REST API to post comments to a GitHub issue, first sending a test string and then exfiltrating host and network information. The demonstration included compiling and running the sample on Windows 10 and Windows 11 virtual machines and observing traffic to a GitHub API IP address.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers analyzed a **Rust-based information stealer** targeting Windows systems that harvested data from **Chromium-based browsers**, **Discord**, **Steam**, and multiple **cryptocurrency wallets**. The malware used anti-debugging checks, staged stolen files in directories disguised as Microsoft security paths, and compressed the collected data into a ZIP archive before exfiltration. The sample uploaded the archive to **gofile.io** and then attempted to send a JSON summary of the victim and stolen data to an attacker-controlled **GitHub Codespaces** endpoint on port `8080`. Investigators found the webhook attempt failed with an HTTP `302` response, but the Gofile archive remained publicly accessible without authentication, and code similarities suggested the stealer was based on or inspired by a publicly available Rust stealer repository on GitHub.
Aug 14, 2026
Researchers reported that the **Drokbk** malware family uses **GitHub** as a dead drop resolver to obtain command-and-control infrastructure, allowing infected systems to retrieve operational data from a trusted public platform instead of contacting attacker-controlled servers directly. The technique helps the malware blend into normal network traffic and complicates blocking and attribution, because defenders may see connections to GitHub rather than an obvious malicious domain. Coverage from Sophos and Secureworks highlights the same campaign behavior: Drokbk relies on content hosted on GitHub to resolve or update the next-stage destination used for attacker communications. The approach reflects a broader trend of threat actors abusing legitimate cloud and developer services for resilience and stealth, underscoring the need for defenders to inspect outbound traffic patterns, monitor unusual access to public repositories, and correlate GitHub activity with endpoint indicators of compromise.
Jun 29, 2026
Threat actors abused GitHub to distribute malware by cloning legitimate repositories, impersonating trusted open-source projects, and poisoning search results to steer victims to trojanized downloads. One campaign spoofed the **AIMMY** game-cheat project through a cloned repository and the lookalike site `aimmy.app`, while also exploiting GitHub's issue-draft upload behavior to host malicious files on the original benign repository via direct links that appeared trustworthy. The delivered packages included files such as `Aimmy.bat`, `AimmyLauncher.exe`, `lua51.dll`, and supporting data, with the malware implemented through obfuscated **LuaJIT** code. Follow-on analysis tied similar GitHub repo poisoning activity to **SmartLoader**, which used trojanized `lua51.dll` components and heavily obfuscated Lua payloads to deploy **StealC** infostealer. The malware performed anti-debugging and anti-tamper checks, captured screenshots, verified connectivity and geolocation, and fetched additional payloads from attacker-controlled GitHub repositories. Researchers found it also used the **EtherHiding** technique, querying the Polygon PoS blockchain for dynamically updated command-and-control data, before exfiltrating browser credentials, cookies, cryptocurrency wallet information, and email data to attacker infrastructure including `213.176.72[.]200`.
Aug 15, 2026