Cybercriminals Use GitHub to Distribute Lumma Stealer

Trend Micro’s Managed XDR team recently uncovered a malware campaign using GitHub’s release infrastructure to spread Lumma Stealer, SectopRAT, Vidar, and Cobeacon malware. This highlights how attackers are using trusted platforms to deliver harmful payloads.

The attack starts when users download files from temporary secure URLs on GitHub. These files, including Pictore.exe and App_aeIGCY3g.exe, are Lumma Stealer variants that steal sensitive data like credentials, cryptocurrency wallets, and system details, while also connecting to command-and-control servers.

The malicious files, signed with revoked certificates, use GitHub repositories for distribution and rely on PowerShell scripts and shell commands to stay hidden and persist.

Further analysis shows the campaign shares tactics with the Stargazer Goblin group, a known threat actor that uses compromised websites and GitHub for payload delivery.

The consistent URL patterns and redirection to GitHub-hosted malware suggest careful planning.

“The infection chain is complex and uses modular deployment. The initial Lumma Stealer files drop and run additional malware, including:

• SectopRAT: Provides remote access and steals data, including browser info, while maintaining persistence through startup entries and scheduled tasks.
• Vidar: Steals browser data and cloud storage files, connecting to external C&C servers to exfiltrate data.
• Lumma Stealer Variant: Uses obfuscated PowerShell scripts to contact malicious domains, download payloads, and steal sensitive details.

The attackers used advanced evasion techniques, like Electron-based frameworks and custom settings, to avoid detection.

Connections to IPs like 192[.]142[.]10[.]246 and domains like lumdukekiy[.]shop enabled external communication.

Recon commands and code flags gathered system info stealthily.

This campaign shows attackers using GitHub to bypass defenses and deploy multiple malware families, including Lumma Stealer, for modular attacks.

Trend Micro’s Managed XDR platform uncovered the campaign, highlighting the need for strong threat intelligence and proactive monitoring.

IOCs