MEDIUMMalware
Global

GitHub Used as Covert Channel in Multi-Stage Malware Campaign

Thursday, April 2, 2026 at 01:00 PM UTC·Source: Infosecurity Magazine

Updated: Thursday, April 2, 2026 at 05:46 PM UTC

Executive Summary

LNK files use GitHub C2, embedded decoders and PowerShell for persistence and data exfiltration

Analysis

LNK files use GitHub C2, embedded decoders and PowerShell for persistence and data exfiltration
Source Attribution

Originally published by Infosecurity Magazine on Apr 2, 2026.

Related Threats

MEDIUMMalware

Claude Code leak used to push infostealer malware on GitHub

Threat actors are exploiting the recent Claude Code source code leak by using fake GitHub repositories to deliver Vidar information-stealing malware. [...]

BleepingComputer
MEDIUMMalware

Bank Trojan 'Casbaneiro' Worms Through Latin America

Augmented Marauder's multipronged banking-Trojan cyber campaigns are targeting Spanish speakers, evading detection, and replicating rapidly.

Dark Reading
MEDIUMMalware

Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners

A financially motivated operation codenamed REF1695 has been observed leveraging fake installers to deploy remote access trojans (RATs) and cryptocurrency miners since November 2023. "Beyond cryptomining, the threat actor monetizes infections through CPA (Cost Per Action) fraud, directing victims to content locker pages under the guise of software registration," Elastic

The Hacker News