Botnet Abuses GitHub Repositories to Spread Malware

Threat actors are using public GitHub repositories to host and distribute malware through the Amadey botnet in an ongoing campaign linked to a broader malware-as-a-service operation, Cisco Talos reported.

See Also: AI vs. AI: Leveling the Defense Playing Field

The campaign, observed in April, reveals how fake GitHub accounts were used to host malicious payloads, tools and Amadey plug-ins, enabling operators and take advantage of GitHub’s legitimate traffic patterns – “likely as an attempt to bypass web filtering and for ease of use,” Cisco Talos said in a report published Thursday.

Talos researchers Chris Neal and Craig Jackson said that the operation overlaps with a previously identified phishing campaign from early 2025 that deployed SmokeLoader malware against Ukrainian organizations. While the original campaign used invoice-themed phishing emails and JavaScript-based loaders to deploy SmokeLoader, the new activity uses a similar multistage loader, Emmenhtal, to deliver Amadey, which then fetches a variety of malware payloads from GitHub repositories.

Emmenhtal, also referred to as PEAKLIGHT, uses layers of obfuscated JavaScript and PowerShell scripts to deliver final payloads. In this campaign, those payloads include Amadey, AsyncRAT, PuTTY and other tools indicating a MaaS model where various malware families are distributed for different clients. Talos researchers also identified Emmenhtal variants disguised as MP4 files, further evading detection.

Three fake GitHub accounts, “Legendary99999,” “DFfe9ewf” and “Milidmdds,” served as the primary distribution points. “Legendary99999,” in particular, hosted over 160 repositories, each with unique payloads accessible via GitHub’s “Releases” section. These payloads ranged from commodity infostealers like Lumma and Redline to legitimate software such as PuTTY.exe, potentially used for post-exploitation activity.

The use of GitHub poses challenges for enterprise defenders, especially in development environments where GitHub access is routine. “A malicious GitHub download may be difficult to differentiate from regular web traffic,” the report said. Attackers likely exploit this trust to quietly deploy malware in enterprise environments.

Talos said that it reported the malicious accounts to GitHub, which swiftly took them down. But additional accounts believed to be associated with the operation were also discovered, raising concerns about the scale and longevity of the compromise.

One notable variant found on GitHub “checkBalance.py” was a Python script disguised as a cryptocurrency tool. It contained embedded Base64-encoded PowerShell commands that eventually downloaded Amadey and contacted a known command-and-control server.

Amadey, first seen in 2018 on Russian-speaking forums, is a modular bot primarily used for reconnaissance and payload delivery. It is capable of collecting system information and deploying plug-ins for credential harvesting, screenshot capture and other malicious tasks. Its presence in this MaaS operation underscores the evolving threat posed by publicly available infrastructure being co-opted for malware distribution.

The campaign once again demonstrates how open platforms can be turned into covert malware delivery channels. Organizations are advised to scrutinize GitHub traffic, limit access where feasible and deploy advanced threat detection mechanisms to catch unusual download patterns and PowerShell execution behaviors.