“Repo Squatting”: How Hackers Are Using GitHub’s Own Features to Hijack Official Repos

A GMO Cybersecurity report documents a “repo squatting” supply-chain style campaign where attackers exploited GitHub’s fork/commit URL behavior to host a malicious GitHub Desktop installer containing the HijackLoader multi-stage loader; the technique made malicious downloads appear to originate from the official repository, was active in Sep–Oct 2025, and remained reproducible as of Dec 29, 2025.