North Korea Uses GitHub as C2 in New LNK Phishing Campaign

FortiGuard Labs documents a DPRK-linked phishing campaign targeting users in South Korea that uses malicious LNK shortcuts containing embedded decoy PDFs and encoded payloads; the LNKs drop and execute PowerShell/VBScript loaders which perform environment checks, establish persistence via Scheduled Tasks, and use GitHub repositories and API tokens as a stealthy HTTPS-based C2 and exfiltration channel, with overlaps across multiple attacker-owned GitHub accounts and a potential follow-on delivery of XenoRAT.