Water Curse is a threat cluster tracked by Trend Micro that operates a GitHub-based ghost network to redirect users to malware-laced payloads. It shares tactical overlaps with the campaign abusing GitHub Actions to target cPanel and WHM servers, as well as Operation Muck and Load which delivers Windows malware.