InfoSecBulletin Cybersecurity for mankind
Recorded Future’s Insikt Group has discovered a major cyber threat campaign carried out by Russian-speaking hackers, possibly located in the Commonwealth of Independent States (CIS).
This campaign misuses GitHub, a platform for software development, to spread different malware. The report explains how attackers pretend to be popular software like 1Password, Bartender 5, and Pixelmator Pro to infect victims with malware that steals information like AMOS, Vidar, Lumma, and Octo. The malware variants have a shared command-and-control infrastructure, indicating a well-coordinated attack strategy to cause the most damage on different platforms.
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
Hackers make GitHub profiles to share infected versions of popular software. When users download these apps, their devices get malware that can steal data and do harmful actions. This shows the hackers are adaptable and use shared command-and-control systems, suggesting a well-organized cyber attack.
Insikt Group’s analysis uncovered various malware families in this campaign, such as:
Atomic macOS Stealer (AMOS): Targets macOS users by impersonating commonly used applications.
Vidar and Lumma: Information stealers that target Windows devices.
Octo: A banking trojan specifically targeting Android devices.
Attackers effectively use GitHub to manage their malicious tools and target various operating systems with different types of malware.
The campaign uses complex tactics such as domain spoofing. This means that users are redirected from harmless websites to harmful GitHub repositories. The malware tricks users by pretending to be a necessary software update or additional software, making them unknowingly download it.
Insikt Group also uncovered the backend infrastructure used in this campaign, including multiple C2 servers and the use of public file-sharing services like Dropbox and Pixeldrain to spread additional payloads. The usage of FileZilla servers for managing and disseminating malware variants highlights the campaign’s sophistication.
Insikt Group recommends several mitigation strategies, including:
*Verify the authenticity of the download sources and maintain updated antivirus and anti-malware solutions.
* Employ tools like GitGuardian and GitHub Advanced Security to scan for potentially malicious code.
* Implement an organization-wide code review process for any externally obtained code before its integration into production environments.
