A Hacker 'Ghost' Network Is Quietly Spreading Malware on GitHub

Cybersecurity researchers have identified a network of approximately 3,000 fake accounts on GitHub, dubbed the "Stargazer Goblin," which is being used to spread malware, including ransomware and information stealers. This network has been active since at least June 2023, manipulating GitHub's platform to promote malicious repositories by using its community tools to create the appearance of legitimacy. The operator of this network employs tactics such as "starring," "forking," and "watching" malicious pages to enhance their visibility and credibility. The malicious repositories often claim to offer free software tools related to social media, gaming, and cryptocurrency, primarily targeting Windows users.

The operator charges other hackers for access to these services, which Check Point refers to as "distribution as a service." The network has been linked to various types of malware, including the Atlantida Stealer and Lumma Stealer. Researchers have noted that the network may be larger than initially thought, with instances of legitimate accounts being compromised to host malicious content. GitHub has responded by disabling user accounts that violate its policies against unlawful content. The activity of the ghost accounts appears to be automated, making it challenging for GitHub to detect. Experts warn that inexperienced users may inadvertently download harmful code due to the deceptive nature of these repositories, emphasizing the need for vigilance when using the platform.