North Korea Uses GitHub as C2 in New LNK Phishing Campaign

A new phishing campaign that uses malicious Windows shortcut (LNK) files to target users in South Korea, while abusing GitHub as Command and Control (C2) infrastructure to hide its activity.

The operation, linked through tooling and tradecraft to North Korea–related actors, shows a clear evolution from earlier, less obfuscated XenoRAT-delivery campaigns observed since 2024.

In the first stage, victims receive LNK files masquerading as documents, often with decoy PDF themes related to business reports or Korean companies.

Earlier variants relied on simple string concatenation to conceal the GitHub C2 URL and access token. However, the underlying intent to pull and run a PowerShell command from GitHub remained obvious on inspection.

Over time, the actors added lightweight decoding routines inside the LNK arguments and began embedding both the decoy PDF and the next-stage PowerShell payload directly within the file, encoded and passed to a custom function (p1) that uses parameters such as location, length, and an XOR key to decode content.

FortiGuard Labs recently detected a series of LNK files targeting users in South Korea. When opened, these shortcuts execute embedded scripts rather than simply opening a document.

This function first drops the decoy PDF so the victim sees an apparently normal document, then silently decodes and launches the PowerShell script in the background.

Earlier samples exposed rich metadata like repeated file names, sizes, modification dates, and the “Hangul Document” name pattern, a label frequently seen in North Korea–linked espionage activity. These clues have now been stripped in the latest iterations to reduce attribution and detection.

LNK Phishing Campaign

The second stage PowerShell script focuses on anti-analysis, persistence, and initial reconnaissance.

It begins with an extensive environment check, scanning running processes for virtualization artifacts, debuggers, and popular security tools such as IDA, x64dbg, Wireshark, Fiddler, Process Hacker, and Sysinternals utilities.

If any of these indicators appear, the script terminates immediately to frustrate both sandboxing and manual analysis. This mirrors defensive-evasion behavior previously documented in DPRK-linked espionage operations using XenoRAT and other tooling.

If the environment appears clean, the script reconstructs and Base64-decodes multiple strings, writing an obfuscated VBScript payload into a randomly named folder under %Temp%.

It then establishes persistence via a Scheduled Task that launches wscript.exe against this VBScript every 30 minutes, with a task name crafted to look like a benign technical document reference.

The decoy PDF aligns with the theme of the LNK file, fooling victims into thinking the file opened normally while the malicious PowerShell script executes silently in the background.

The VBScript in turn executes the PowerShell payload in a hidden window, minimizing visible artifacts for the user.The script next profiles the system, collecting OS version, build, uptime, and a full process list.

It saves this data into log files named using a timestamp and IP address, then uploads them to a GitHub API endpoint tied to the “motoralis/singled” repository, authenticated via a hardcoded access token.

Activity clustering shows that this account has been used consistently since 2025, and infrastructure overlaps link it to additional GitHub accounts such as God0808RAMA, Pigresy80, entire73, pandora0009, and brandonleeodd93-blip forming a broader C2 and exfiltration ecosystem built entirely on GitHub repositories.

Persistent GitHub-based C2

In the third stage, a follow-on PowerShell script maintains the live C2 channel. It periodically retrieves instructions or additional modules from a raw GitHub URL under the same “motoralis/singled” project path and executes the fetched content.

Because all traffic flows over legitimate GitHub domains and uses HTTPS, the communication blends into normal developer or enterprise activity and often bypasses basic domain-based filtering.

The operators also run a “keep-alive” script that harvests network configuration data from infected hosts and uploads it back to GitHub, writing logs under paths that include the victim’s IP address and timestamp.

This regular check-in lets the attackers track online status and network changes, preparing for further lateral movement or the deployment of heavier payloads, such as XenoRAT, when conditions are favorable.

Similar GitHub-centered espionage chains delivering XenoRAT have been recently documented in other DPRK-linked campaigns targeting diplomatic and government networks.

This campaign underlines how North Korea–related threat actors increasingly rely on native Windows tools (PowerShell, VBScript, and Scheduled Tasks) and trusted cloud services rather than custom binaries, dramatically lowering their detection footprint.

By hiding commands, logs, and payload loaders inside private GitHub repositories, they exploit the platform’s good reputation and common allowlisting in corporate environments to maintain a resilient, low-noise C2 channel.

Organizations should treat unusual PowerShell or script activity especially process scans, %Temp%-resident scripts, and suspicious Scheduled Tasks launching wscript.exe as high-priority alerts.

Tightening monitoring of GitHub API and raw content access, enforcing least-privilege egress policies, and educating staff about LNK-based phishing lures disguised as documents are critical steps to detect and disrupt similar GitHub-based espionage operations.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.