Back Gbhackers

North Korea Uses GitHub as C2 in New LNK Phishing Campaign

Gbhackers •Mayura Kathir • April 3, 2026

A new phishing campaign that uses malicious Windows shortcut (LNK) files to target users in South Korea, while abusing GitHub as Command and Control (C2) infrastructure to hide its activity. The operation, linked through tooling and tradecraft to North Korea–related actors, shows a clear evolution from earlier, less obfuscated XenoRAT-delivery campaigns observed since 2024. In […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Actors Exploit GitHub in Multi-Stage Malware Campaign Against South Korea A sophisticated malware campaign targeting users in South Korea has been identified, utilizing malicious LNK files that leverage GitHub as a command and control (C2) infrastructure. The campaign, attributed to North Korean state actors, employs a multi-stage attack chain that includes hidden PowerShell scripts and decoy PDF documents to evade detection. Initial versions of the malware date back to 2024, but recent iterations have removed identifying metadata and introduced advanced obfuscation techniques. The attack begins with LNK files that execute scripts to retrieve commands from GitHub, allowing attackers to maintain persistence and exfiltrate sensitive data. The malware continuously connects to GitHub to download additional payloads and instructions, raising alarms about the use of legitimate platforms for malicious activities. Security experts emphasize the need for heightened vigilance as this method blurs the lines between normal and malicious traffic. 8 sources 76

Extracted Entities

North Korea Uses GitHub as C2 in New LNK Phishing Campaign

The full story

Extracted Entities

Attack Types (1)

Countries (2)

Malware (1)

MITRE ATT&CK (2)

Platforms (2)