Hackers Abuse GitHub and GitLab to Host Malware and Credential Phishing Campaigns

**Executive summary:** Threat actors are increasingly abusing trusted developer platforms (GitHub and GitLab) to host malicious files and credential phishing pages, enabling large-scale phishing campaigns that deliver Remote Access Trojans (e.g., Remcos, Byakugan, AsyncRAT, DcRAT) and info-stealers (e.g., Muck Stealer). These attacks exploit domain trust, use techniques such as password-protected archives and user-agent based delivery to evade detection, and combined malware+credential-theft campaigns are rising rapidly (2025 accounted for 45% of observed campaign volume).