Threats Tagged 'github lure network'

A malicious Go module masquerading as a DNS/subdomain scanner has been identified as part of a sophisticated Windows malware staging operation named 'Muck and Load'. This operation uses a large GitHub-based infrastructure of 222 repositories across 190 accounts, employing automated workflows to appear legitimate. The malicious module downloads encoded PowerShell scripts that retrieve encrypted payloads from public platforms like Pastebin and Telegram. These payloads include well-known malware such as AsyncRAT, Quasar, Remcos, and Vidar infostealers, which are executed from disguised Microsoft-themed directories. At least 14 malware files have been confirmed within this network.