The operation leverages fake GitHub accounts to host an arsenal of malware tools, plugins, and payloads, capitalizing on GitHub’s widespread corporate acceptance to bypass traditional web filtering mechanisms. The researchers discovered that the same Emmenhtal loader variant used in the SmokeLoader campaign was being repurposed to deliver Amadey payloads and other malicious tools. The operation’s adaptability is further demonstrated by its ability to deliver legitimate tools like PuTTY.exe alongside malicious payloads, showcasing the MaaS model’s flexibility in meeting various client requirements. A sophisticated Malware-as-a-Service operation has emerged that exploits the trusted GitHub platform to distribute malicious payloads, representing a significant evolution in cybercriminal tactics. The operation’s infrastructure demonstrates remarkable sophistication, utilizing public GitHub repositories as open directories for staging custom payloads across multiple malware families. This multi-stage approach allows the malware to deliver diverse payloads including information stealers like Rhadamanthys, Lumma, and Redline, as well as remote access trojans such as AsyncRAT. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. These archives conceal JavaScript files that employ multiple layers of obfuscation to disguise PowerShell downloaders, ultimately delivering the Amadey malware and its associated tooling. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. This initial obfuscation layer effectively conceals the malicious code from basic static analysis tools. The Emmenhtal loader serves as the primary infection vector, employing a sophisticated four-layer obfuscation scheme that demonstrates advanced evasion capabilities. The malicious campaign targets Ukrainian entities through carefully crafted phishing emails containing compressed archive attachments. However, Cisco Talos analysts identified the broader scope of the operation in April 2025, revealing its true nature as a comprehensive MaaS platform. The second layer utilizes the ActiveXObject function to execute an encoded PowerShell command through WScript.Shell, while the third layer contains a PowerShell command with an AES-encrypted binary blob. The most active account, Legendary99999, contained over 160 repositories with randomized names, each hosting a single malicious file in the “Releases” section. The threat actors created three primary accounts—Legendary99999, DFfe9ewf, and Milidmdds—each serving distinct purposes within the malware distribution network.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 18 Jul 2025 12:30:13 +0000