The strange tale of ischhfd83: When cybercriminals eat their own

This investigation uncovered a large-scale campaign involving backdoored GitHub repositories targeting game cheaters and inexperienced cybercriminals. The threat actor, possibly linked to a Distribution-as-a-Service operation, uses multiple types of backdoors and a convoluted infection chain leading to RATs and infostealers. The campaign involves automated commits, obfuscation techniques, and complex payloads. Researchers found over 100 malicious repositories with distinct contributor roles, suggesting an automated framework. The eventual payload includes AsyncRAT, Remcos, and Lumma Stealer. The threat actor uses Telegram for notifications and various paste sites for hosting malicious code. This case highlights the complexity of modern cyber threats and the importance of cautious approaches to open-source repositories.

• Inside SiriusQT: A Seriously Skilled RATMalware2026-10-22
• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• Uncovering a SectopRAT Variant Embedded in Legitimate SoftwareMalware2026-09-25
• Infostealer riding the AI TrainMalware2026-10-23
• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking MalwareMalware2026-10-21