A Hacker 'Ghost' Network Is Quietly Spreading Malware on GitHub

Cybersecurity researchers have identified a network of approximately 3,000 fake accounts on GitHub, dubbed the "Stargazer Goblin," which is being used to spread malware, including ransomware and information stealers. This network has been active since at least June 2023, manipulating GitHub's community tools to promote malicious repositories that appear legitimate. The operator of this network employs tactics such as "starring," "forking," and "watching" these repositories to enhance their credibility. The malicious content often masquerades as tools for social media, gaming, and cryptocurrency, primarily targeting Windows users searching for free software.

The operator charges other hackers for access to these services, which Check Point refers to as "distribution as a service." The network has been linked to various types of malware, including the Atlantida Stealer and Lumma Stealer. Researchers have noted that some legitimate GitHub accounts have been compromised to facilitate this operation. GitHub has responded by disabling accounts that violate its policies against unlawful content. The scale of the network may be larger than currently understood, as automated actions by the fake accounts make detection challenging. Experts warn that inexperienced users are particularly vulnerable to downloading malicious code, often influenced by fictitious reviews and stars. The research highlights ongoing concerns about the security of open-source platforms and the tactics employed by cybercriminals to exploit them.