GitHub and GitLab are essential tools for programmers, project managers, and software developers worldwide. However, this widespread trust is increasingly being weaponized by cybercriminals.
Because these Git repository platforms are critical for business operations, enterprise networks cannot simply block them.
Threat actors are exploiting this required access, uploading malware and credential-phishing pages to generate malicious links that bypass traditional secure email gateways (SEGs).
Mechanics Of Cloud Platform Abuse
To execute these attacks, cybercriminals exploit the core features of Git platforms. When distributing malware, attackers typically rely on primary domains like github.com, githubusercontent.com, and gitlab.com.
For example, 53% of campaigns that abuse GitHub domains focus on malware delivery.
Attackers often use the raw, plain-text file versions hosted on githubusercontent.com to quietly download payloads in the background without triggering the platform’s standard user interface.
Similarly, 64% of campaigns abusing GitLab domains are built exclusively to deliver malware. To evade anti-malware scanners, attackers frequently hide their payloads within password-protected archive files, such as .zip and .7z.
When delivering malware, attackers heavily favor Remote Access Trojans (RATs) and Information Stealers. Over 30 different malware families have been observed in these campaigns.
The most prevalent payload is the Remcos RAT, accounting for 21% of the overall volume and dominating GitHub attacks.
Other frequent payloads include the Byakugan stealer, Async RAT, and DcRAT the most popular payload delivered via GitLab.
These tools grant attackers remote control over infected devices, allowing them to steal browser passwords or exfiltrate sensitive files for extortion.
Perhaps the most alarming development is the rise of hybrid, dual-threat attacks. Modern threat actors are combining malware and credential phishing into highly evasive attack chains.
For example, some campaigns successfully use GitHub to deploy an information stealer, followed immediately by a fake document pop-up that phishes for credentials. This guarantees both persistent device access and immediate credential theft.
GitLab hosts equally sophisticated campaigns utilizing device detection. By analyzing the victim’s browser user agent, the malicious landing page dynamically determines the payload.
If the victim is on a Windows computer, the page delivers an abused legitimate remote administration tool, such as the GoTo RAT. If accessed from a Mac or Android device, the page switches tactics to serve a credential phishing portal instead.
According to Cofense research, because legitimate infrastructure is hijacked, mitigating this threat is incredibly difficult. Platforms actively remove malicious content, but the sheer volume of content delays purges, sometimes taking weeks to purge flagged repositories.
Defending against this trend requires a layered security approach and heightened user vigilance, as traditional blocklisting methods fail against trusted cloud collaboration platforms.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
