More than a hundred backdoored malware repos traced to single GitHub user

Sophos investigators uncovered a large-scale campaign attributed to 'ischhfd83' that created and automated hundreds of GitHub repositories—many marketed as game cheats or tools—but backdoored to install infostealers, RATs and other malware via PreBuild events and GitHub Actions; the activity (141 repos examined, 133 backdoored) appears to function as a distribution-as-a-service targeting novice cybercriminals and cheaters and has links to similar supply-chain efforts tracked since 2022.