Cybersecurity researchers at FortiGuard Labs have uncovered a highly sophisticated phishing campaign targeting various companies in South Korea.
Threat actors, exhibiting tactics strongly linked to North Korean state-sponsored groups, are actively exploiting GitHub as a Command and Control (C2) server to orchestrate stealthy, multi-stage attacks.
By abusing legitimate platforms and relying on native Windows tools, the attackers successfully bypass standard security defenses, turning a trusted open-source platform into a covert hub for malicious operations.
The Multi-Stage Infection Process
The attack chain begins when a targeted user receives a malicious LNK file deliberately disguised as a standard, harmless PDF document.
When the unsuspecting victim clicks the file, it simultaneously displays a decoy PDF to avoid suspicion and silently runs a background decoding function.
This function unpacks a malicious PowerShell script, triggering a sequence of stealthy system compromises to establish persistent access.
Abusing Trusted Infrastructure
The most alarming aspect of this targeted campaign is the strategic abuse of GitHub’s API to manage the compromised machines.
By routing their Command and Control communications through GitHub, the attackers successfully hide their malicious traffic within normal, encrypted web connections.
Since corporate environments widely trust and allowlist GitHub for software development, automated data exfiltration easily blends in with regular network activity.
The attackers actively manage a complex network of active and dormant GitHub accounts to sustain their espionage operations over long periods.
The primary account, identified as “motoralis,” serves as the central operational hub for receiving stolen data and issuing new malicious commands.
Other secondary accounts remain largely inactive for months, acting as immediate backup infrastructure to provide redundancy if the main account is discovered.
Through a dedicated “keep-alive” script, the threat actors continuously monitor the victim’s network status in real time.
This mechanism fetches additional modules from their private GitHub repositories to deepen their control over the compromised environment.
This combination of legitimate tools and trusted web services creates a highly effective infection chain that completely bypasses corporate security filters.
This phishing campaign highlights a dangerous and growing trend among advanced cybercriminals: minimizing the use of custom malware files in favor of “Living off the Land” techniques.
By relying almost entirely on native Windows tools like PowerShell and VBScript, the attackers significantly reduce their digital footprint.
Organizations are strongly advised to remain vigilant against untrusted documents and deploy advanced endpoint protection to stop these invisible threats.
Fortinet’s advanced security solutions, including FortiGuard Antivirus and FortiMail, have been updated to detect and neutralize these specific malicious LNK files proactively.
Security teams can also utilize Content Disarm and Reconstruction (CDR) services to strip active code from suspicious documents while preserving their usability.
These defensive measures are essential to blocking the infrastructure associated with this campaign and protecting sensitive corporate data.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
