Malicious LNK GitHub C2 campaign targeting South Korea
Campaign
Summary
Hide ▲
Show ▼
A malicious LNK-file campaign targeting users in South Korea is using GitHub as C2 to support persistent access on Windows systems. The operation relies on PowerShell, scheduled tasks, and decoy PDFs to stay hidden while malicious code runs. Recent variants add embedded decoding logic and encoded payloads, showing an evolving threat that has continued since 2024.
Related Happenings
Ghostcommit PNG-embedded prompt injection against AI code reviewers
Technical Analysis
H score25
First: 11.07.2026 12:03
Last: 11.07.2026 12:03
Sources 1
About this happening:
Researchers demonstrated Ghostcommit, a PNG-embedded prompt-injection technique that can bypass AI code review and leak .env secrets into committed source. The pay...
Ghostcommit PNG-embedded prompt injection against AI code reviewers
Technical AnalysisAbout this happening: Researchers demonstrated Ghostcommit, a PNG-embedded prompt-injection technique that can bypass AI code review and leak .env secrets into committed source. The pay...
Shai-Hulud supply-chain campaign spreading via stolen CI/CD credentials
Campaign
H score56
First: 12.05.2026 14:29
Last: 12.05.2026 14:29
Sources 1
About this happening:
GitHub said it removed more than 500 compromised npm packages in September 2025 and moved to harden publishing after early Shai-Hulud activity. In May 2026, researcher...
Shai-Hulud supply-chain campaign spreading via stolen CI/CD credentials
CampaignAbout this happening: GitHub said it removed more than 500 compromised npm packages in September 2025 and moved to harden publishing after early Shai-Hulud activity. In May 2026, researcher...
EtherRAT malicious MSI loader with Ethereum-based C2
Malware Activity
H score23
First: 30.04.2026 14:30
Last: 30.04.2026 14:30
Sources 1
About this happening:
The EtherRAT malware is being delivered through malicious MSI installers and gives attackers persistent Windows access, increasing the risk of covert control inside en...
EtherRAT malicious MSI loader with Ethereum-based C2
Malware ActivityAbout this happening: The EtherRAT malware is being delivered through malicious MSI installers and gives attackers persistent Windows access, increasing the risk of covert control inside en...
Famous Chollima PromptMink supply-chain campaign targeting Web3 developers
Campaign
H score44
First: 29.04.2026 17:43
Last: 29.04.2026 17:43
Sources 1
About this happening:
The PromptMink campaign is widening Famous Chollima's supply-chain intrusion playbook by pushing tainted npm packages into developer environments and stealing secrets....
Famous Chollima PromptMink supply-chain campaign targeting Web3 developers
CampaignAbout this happening: The PromptMink campaign is widening Famous Chollima's supply-chain intrusion playbook by pushing tainted npm packages into developer environments and stealing secrets....
Tropic Trooper trojanized SumatraPDF remote-access campaign
Campaign
H score34
First: 24.04.2026 12:29
Last: 24.04.2026 12:29
Sources 1
About this happening:
Tropic Trooper is running an active campaign that uses a trojanized SumatraPDF lure to plant AdaptixC2 Beacon and later abuse VS Code tunnels for remote access...
Tropic Trooper trojanized SumatraPDF remote-access campaign
CampaignAbout this happening: Tropic Trooper is running an active campaign that uses a trojanized SumatraPDF lure to plant AdaptixC2 Beacon and later abuse VS Code tunnels for remote access...
Timeline
-
02.04.2026 16:00 2 articles · 3mo ago
Fortinet advisory describes South Korea LNK malware campaign using GitHub C2
Technical Analysis UpdateFortinet published an advisory describing a malicious LNK-file campaign targeting users in South Korea that uses GitHub as command and control (C2). The operation relies on hidden scripts, encoded payloads, PowerShell, VBScript, scheduled tasks, decoy PDF documents, and Windows built-in tools to maintain persistence, exfiltrate system information, and evade detection, while later variants add decoding functions directly in LNK arguments and remove identifying metadata; earlier versions of the attack date back to 2024.
Show sources
- GitHub Used as Covert Channel in Multi-Stage Malware Campaign — www.infosecurity-magazine.com — 02.04.2026 16:00
- GitHub Used as Covert Channel in Multi-Stage Malware Campaign — www.infosecurity-magazine.com — 02.04.2026 16:00