How ‘Stargazer Goblin’ leveraged GitHub for large-scale malware attacks

A new malware-as-a-service (MaaS) operation, dubbed “Stargazer Goblin” by cybersecurity experts at Check Point Research, emerged on GitHub this year, posing a significant threat to internet users worldwide. The operation , which utilizes over 3,000 fake GitHub accounts to spread malware, represents a disturbing trend in the evolution of cybercrime, exploiting the trusted nature of open-source platforms to deceive users.

As cybercriminals adapt to evolving security measures, their tactics become more sophisticated, leveraging familiar platforms like GitHub as vectors for malware distribution. This shift in tactics highlights the growing complexity of modern cyber threats and the challenges posed by widely trusted platforms in the fight against malware.

How GitHub became a target for cybercrime

GitHub, widely regarded as the most popular platform for software development and collaboration, has long been a trusted resource for developers. Its open and transparent nature allows users to create repositories, share code, and contribute to open-source projects. However, this same openness has made it an attractive target for cybercriminals.

Unlike platforms with stricter user controls, GitHub’s flexibility allows almost anyone to create repositories and share files, making it difficult to identify malicious activities among legitimate users. In the past, cybercriminals relied on platforms like Dropbox and Google Drive to spread malware, but as these services implemented stricter security measures, criminals began looking for new opportunities. GitHub, with its respected reputation and open structure, became an ideal alternative.

Introducing Stargazers Ghost Network

The “Stargazer Ghost Network” represents one of the most sophisticated examples of cybercriminals exploiting GitHub. According to Check Point Research, the operation relies on thousands of fake GitHub accounts, each designed to distribute malware. These accounts collaborate to create the illusion of legitimate, active repositories by starring, forking, and subscribing to each other’s projects.

By creating this facade of authenticity, the attackers are able to deceive users and GitHub’s moderation systems, allowing their malicious repositories to go unnoticed. The scale and complexity of the operation make it a significant case study of how cybercriminals are manipulating trusted platforms.

The inner workings of Stargazer Goblin’s campaign

According to Check Point Research’s Antonis Terefos, the Stargazer Goblin network operates by establishing malicious repositories disguised as legitimate projects, often centered around popular topics like gaming and cryptocurrencies. These repositories are clones of real projects, designed to trick users into downloading malware.

For instance, when a user downloads one of these fake repositories, they might find password-protected zip files that contain trojan malware. These malware strains—such as Redline, Lumma Stealer, Rhadamanthys, RisePro, and Atlantida Stealer—are designed to steal sensitive information, install spyware, or give attackers remote control over the victim’s computer.

Social engineering and phishing precision

In addition to distributing malware through GitHub, the Stargazer Goblin operation also employs social engineering and phishing attacks. These phishing campaigns are carefully targeted, often focusing on industries like gaming and cryptocurrency, where attackers can extract valuable data.

Phishing emails often include links to malicious GitHub repositories, increasing the likelihood that recipients will click on them and unknowingly download malware. Within a short time, thousands of potential victims have fallen prey to these tactics, making Stargazer Goblin a highly effective operation.

GitHub’s response and the ongoing battle

GitHub has been actively working to remove the malicious repositories linked to the Stargazer Goblin network. To date, over 1,500 repositories have been taken down, but the attackers remain persistent. The network’s accounts are organized into distinct roles—managing phishing templates, handling phishing images, and deploying malware. This structure allows them to quickly replace any accounts or repositories that are detected and removed.

Despite GitHub’s efforts, the Stargazer Goblin network has proven to be highly adaptable. Each time a repository is dismantled, new ones are quickly established, complete with revamped phishing strategies and fresh links to distribute malware

Financial motivation: A lucrative operation

At the heart of the Stargazer Goblin network is a clear financial incentive. Check Point Research estimates that the operation has generated around $100,000 since its inception, primarily through the theft of financial information, sensitive credentials, and other valuable data. This information is often sold on the dark web or used to gain unauthorized access to accounts.

Worryingly, the operation is not limited to GitHub. Members of the Stargazer Goblin network have also been observed using social media platforms like Twitter, YouTube, Discord, Instagram, and Facebook to expand their phishing campaigns. By taking advantage of the features on these platforms, they are able to reach an even broader range of potential victims.

The broader implications for cybersecurity

The Stargazers Ghost Network focuses on an emerging aspect of cybercrime: the abuse of legitimate security through trusted services. As more genuine services realize these methods and start trimming their security mechanisms, the bad guys are changing their ways and looking for new services that, up to this point, have yet to be seen as having any security weaknesses.

Github’s case demonstrates how such trusted resources may be turned against the users and, as such, should be taken as an alert on these issues by both software developers and users. Even though GitHub has made lesser progress toward the threat, there is little doubt that information portals will have to deploy more ‘intelligent’ methods that could involve elements of Artificial Intelligence to identify and counter such threats before they materialize.

The Stargazer Goblin network underscores a growing concern in the world of cybersecurity: the exploitation of trusted platforms for malicious purposes. As more services tighten their security measures, cybercriminals are shifting their focus to platforms like GitHub that, until now, have not been seen as vulnerable to such large-scale abuse.

GitHub’s case serves as a stark reminder of how trusted resources can be weaponized, and highlights the need for more advanced detection methods to counteract such threats. Moving forward, developers and users alike must remain vigilant, and platforms like GitHub may need to adopt more sophisticated tools, potentially incorporating artificial intelligence, to identify and neutralize these threats before they spread.