New GitHub Scam Uses Fake “Mods” and “Cracks” to Steal User Data

A research analysis uncovers a widespread campaign using over 1,100 GitHub repositories that masquerade as game modifications and cracked software to distribute the Python-based Redox stealer, which automates credential and cryptocurrency-wallet extraction and exfiltration (via obfuscated Discord webhooks). The report documents social-engineering tactics (topic poisoning, AI-generated READMEs), payload obfuscation (passworded RARs, Anonfiles), technical harvesting modules (browser/Steam/Discord/SQLite scraping, DPAPI-based secrets), active evasion of GitHub detection, and an estimated scale of thousands of victims monthly.