North Korea-Related Campaign Abuses GitHub as C2 in New LNK Phishing Attacks

A North Korean state-sponsored campaign uses weaponized Windows LNK shortcut files that decode and execute PowerShell/VBScript payloads, display decoy PDFs, and use private GitHub repositories as covert C2 and exfiltration channels to conduct long-term surveillance of South Korean organizations; persistence is achieved via scheduled tasks and the campaign shows evolving obfuscation and targeted lure documents.