New Infostealer Campaign Abuses GitHub Releases to Hide Malware Payloads

A new cyberespionage campaign that abuses GitHub Releases and a PE-less Python implant to steal data from targeted Windows systems quietly.

The operation combines social engineering, trusted cloud infrastructure, and multi-stage obfuscation to maintain long-term, covert access to victim machines.

The attack starts with phishing emails carrying a malicious LNK file packed inside a RAR archive, themed around a Russian humanitarian aid request form to build contextual trust with Russian-speaking targets.

In at least one variant, a survey-style lure is also used, indicating the threat actor is actively refining delivery techniques to improve click-through and infection rates.

The LNK shortcut is unusually large because it embeds self-obfuscated Unicode content directly inside the file body, rather than calling an external script.

During execution, PowerShell reads this hidden content from a specific offset, decodes it, and runs it in memory, ensuring the malware will not fully execute if the original LNK is missing from disk, which helps it appear benign in automated sandboxes.

Once executed, the script downloads and opens a Russian-language humanitarian aid application form from the command‑and‑control (C2) server (159.198.41[.]140), saving it to the %TEMP%\open_doc directory.

While the victim reviews the seemingly legitimate PDF, the malware continues installing in the background, with another observed variant loading a survey link hosted on the same C2 infrastructure.

CRIL has uncovered a targeted cyberespionage campaign leveraging social engineering and trusted infrastructure to establish persistent

The malware then bootstraps a self-contained Python environment under %APPDATA%\WindowsHelper, avoiding the need for administrator rights and mimicking a legitimate Windows helper component.

It correctly patches Python’s embedded distribution configuration to enable pip, demonstrating that the operator has genuine development skills and familiarity with Python packaging internals.

Infostealer Campaign Abuses GitHub

The core payload is delivered from a dedicated GitHub account using GitHub Releases rather than normal repository files, a deliberate choice to blend malicious artifacts with routine developer workflows and reduce static scanning coverage.

The same account also hosts clean components such as the Python 3.12 embedded runtime and the pip installer as separate release artifacts, allowing the entire toolchain to be fetched from a single, trusted domain that appears consistent with normal software updates.

Cyble observed frequent republishing of a data.zip release whose SHA-256 hash changed across versions, confirming the actor is continuously updating or recompiling the infostealer payload.

Persistence is achieved using two silent VBScript launchers (for example, run.vbs and launch_module.vbs) that call pythonw.exe without a visible window, combined with a Windows Scheduled Task named “WindowsHelper” configured to run at short intervals and survive reboots.

The main Python payload (module.pyw) is protected with PyArmor v9.2 Pro, making static analysis and decompilation difficult.

Once active, it functions as a full‑spectrum surveillance platform, supporting credential theft, keylogging, clipboard and screenshot capture, file exfiltration, Telegram hijacking, and covert remote access.

The infostealer targets major Chromium-based browsers and Firefox, extracting AES-GCM master keys from Local State files to decrypt stored passwords and cookies across multiple Chrome encryption versions.

It continuously logs keystrokes to a local file and monitors clipboard contents in real time, while the mss library captures regular screenshots that are compressed and uploaded, with old archives pruned to manage disk usage.

The implant recursively scans user directories for high‑value documents, source code, configuration files, and credential stores, skipping low‑value or system locations and tracking processed files in a local SQLite database (inventory_state.db) to avoid duplicate uploads.

It also searches files for 64‑character hexadecimal strings consistent with cryptocurrency private keys and exfiltrates Telegram tdata session folders, effectively granting full account takeover without passwords.

The attacker’s GitHub Release page shows frequent republishing of data.zip, with its sha256 hash changing across versions, confirming the threat actor remains active.

Static analysis shows the capability to silently download and configure RustDesk and AnyDesk, using legitimate binaries (such as RustDesk from its official GitHub Releases) but hiding their windows and sending connection credentials back to the C2 server for persistent remote desktop access.

All collected data flows to a single Flask‑based C2 server at 159.198.41[.]140, hosted on a Namecheap VPS running nginx on Ubuntu, which exposes dedicated endpoints for uploads and RustDesk tunneling and presents a custom dashboard for managing stolen data and live sessions.

Attribution remains open, but the Russian‑language humanitarian aid lures and targeting logic strongly suggest a surveillance‑driven espionage operation against Russian‑speaking individuals or entities involved in aid or civil administration.

Organizations in these sectors should treat humanitarian‑themed email attachments and shortcut files as high‑risk, scrutinize GitHub traffic in proxy logs, and monitor for anomalous Python, RustDesk, and AnyDesk activity on endpoints.

Indicators of Compromise (IOCs)

Indicator	Indicator Type	Description
8a100cbdf79231e70cee2364ebd9a4433fda6b4de4929d705f26f7b68d6aeb79	SHA-256	Initial LNK dropper
9be61c95056fd6b63565cf51a196f2615f5360c0a42e616b2a618473e9d60a21	SHA-256	Dementyeva_Anna_Vasilyevna_zayavka_gumanitarnayapomosch.rar
hxxp://159.198.41.140/static/builder/lnk_uploads/invo[.]pdf	URL	Lure PDF download
hxxp://159.198.41.140/test/index.php?r=survey/index&sid=936926&newtest=Y&lang=ru%22	URL	Survey URL
hxxps://github.com/leravalera2/dtfls/releases/download/dtfls/data.zip	URL	PyArmour packed malicious scripts
a5b782901829861a6f458db404e8ec1a99c65a48393525e681742bb2a5db454d	SHA-256	module.pyw – packed Python stealer/RAT

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.