Threat Actors Exploit GitHub Accounts to Host Payloads, Tools, and Amadey Malware Plugins

Cisco Talos researchers identified a sophisticated Malware-as-a-Service (MaaS) operation in April 2025 that employed the Amadey botnet to distribute various payloads.

This operation exploited fake GitHub accounts as open directories for hosting malicious payloads, tools, and Amadey plugins, aiming to evade web filtering mechanisms and simplify distribution.

By leveraging GitHub’s legitimate domain, threat actors could bypass organizational security controls that might otherwise block suspicious downloads, particularly in environments where GitHub access is essential for software development.

Malware-as-a-Service Operation

The MaaS model allows operators to sell access to malware infrastructure, with Amadey serving as a modular downloader capable of deploying information stealers like Redline, Lumma, and StealC, alongside custom plugins for functions such as credential harvesting and screenshot capture.

Initial activity traces back to February 2025, coinciding with a separate SmokeLoader phishing campaign targeting Ukrainian entities, highlighting overlapping tactics, techniques, and procedures (TTPs) including the use of the Emmenhtal multistage loader.

The Emmenhtal loader, a multistage downloader first detailed by Orange Cyberdefense in August 2024 and alternatively known as PEAKLIGHT by Mandiant, features four layers of obfuscation culminating in a PowerShell script that fetches next-stage payloads.

In the SmokeLoader campaign observed in early February 2025, phishing emails with compressed archives (ZIP, 7Zip, or RAR) delivered obfuscated JavaScript files leading to PowerShell downloaders, ultimately installing SmokeLoader.

Emmenhtal Loader Analysis

Talos analysis of VirusTotal samples revealed structurally similar Emmenhtal variants hosted on public GitHub repositories, which instead deployed Amadey to retrieve payloads from fake accounts.

These repositories, including Legendary99999 with over 160 randomized repositories hosting malware like Rhadamanthys and Lumma, DFfe9ewf as a testing ground with tools like DInvoke and Selenium WebDrivers, and Milidmdds containing Emmenhtal-like JavaScript loaders such as Work.js and Putikatest.js, functioned as staging points.

Downloads occurred via structured URLs in GitHub’s Releases section, enabling seamless payload delivery without overlapping command-and-control (C2) infrastructures between Amadey and secondary malware.

Technical similarities between the campaigns are evident in Emmenhtal’s obfuscation layers: the first maps two-letter variables to numeric values within comma-separated strings; the second employs ActiveXObject via WScript.Shell to execute encoded PowerShell.

The third decrypts an AES-encrypted blob; and the fourth downloads payloads like Amadey, AsyncRAT, or even legitimate tools such as PuTTY.exe, demonstrating the operation’s flexibility for customer-specific needs.

Additional variants include MP4-masquerading files on domains like pivqmane[.]com, aligning with reports of Emmenhtal disguising as media formats, and a purpose-built Python script “checkbalance.py” in Milidmdds repositories.

This script, posing as a Zerion cryptocurrency account enumerator, embeds a Base64-compressed lambda function that executes PowerShell to download Amadey from IP addresses like 185.215.113.16, contacting known C2 servers such as 185.215.113.43/Zu7JuNko/index.php.

Talos reported these accounts to GitHub, resulting in their swift takedown, underscoring the platform’s role in malware distribution and the need for enhanced monitoring.

This MaaS operation, active since early 2025, exemplifies how threat actors repurpose legitimate services for malicious ends, blending phishing, loaders, and modular botnets to target diverse victims while evading detection through non-overlapping C2 and obfuscated delivery chains.

Organizations should configure web filters to scrutinize GitHub traffic and monitor for anomalous downloads to mitigate such threats.

Get Free Ultimate SOC Requirements Checklist Before you build, buy, or switch your SOC for 2025 - Download Now