New Infostealer Campaign Exploits GitHub for Covert Data Theft

A newly identified cyberespionage campaign is leveraging GitHub Releases to host malware disguised as humanitarian aid requests. Named 'HumanitarianBait,' the operation employs social engineering tactics, including phishing emails with malicious LNK files. The malware is a PE-less Python implant designed to steal data from targeted Windows systems. This campaign highlights the increasing sophistication of threat actors in evading security measures. Victims are primarily organizations that may be misled by the humanitarian guise of the attack. The operation combines trusted cloud infrastructure with multi-stage obfuscation techniques to maintain long-term access. Researchers are still assessing the full scope of the impact and the number of affected systems. Currently, no specific CVEs have been disclosed related to this campaign.

Key Points: • The campaign uses GitHub Releases to host malware disguised as humanitarian requests. • Phishing emails with malicious LNK files are the primary attack vector. • The operation employs advanced obfuscation techniques to evade detection.