Polygon Powered: Vietnamese Operator Deploys 16 Generations of LuaJIT Malware via GitHub

Researchers uncovered a year-long, large-scale campaign (active since Mar 2025) that uses 600+ malicious ZIP archives across dozens of GitHub accounts to distribute a multi-stage LuaJIT loader which resolves C2 via a Polygon smart contract and ultimately deploys the StealC information stealer; observed capabilities include credential harvesting, session hijacking, targeted reconnaissance, and optional module delivery, with infrastructure concentrated on bulletproof hosting and evidence pointing to a Vietnamese-speaking operator.