GitHub, GitLab Abused for Malware and Phishing Campaigns

Attackers are increasingly abusing trusted Git repository platforms (primarily GitHub, also GitLab) to host malware and credential-phishing sites that bypass traditional perimeter controls. The report details that ~95% of abuses use GitHub, with 2025 accounting for ~45% of observed campaigns, and describes delivery methods (raw content URLs, github.io/gitlab.io pages), hybrid chains combining RATs and phishing, common malware families (Remcos, Byakugan, Async RAT, DcRAT), and evasion techniques such as password-protected archives and anti-automation gates.