New Phishing Campaign Abuses GitHub to Target South Korea

FortiGuard Labs describes a sophisticated cyberespionage campaign targeting South Korea that uses phishing LNK files to deploy multi-stage scripts (VBScript → PowerShell) and leverages the GitHub API as covert C2; prior payloads have included the XenoRAT remote access trojan. The operation favors living-off-the-land techniques and trusted public infrastructure to evade detection, and the report includes lure document titles, the infection chain, and recommendations to monitor unusual PowerShell/VBScript activity and communications with public repositories.