Inside the AI-Driven “Lure Factory” Flooding GitHub with Trojans

### Executive Summary Netskope Threat Labs uncovered "TroyDen’s Lure Factory," a sophisticated, AI-assisted campaign that has trojanized over 300 GitHub repositories to deliver credential-stealing malware. The operation uses convincing lures, a two-component payload (renamed LuaJIT runtime and encrypted Lua script), advanced sandbox-evasion (including an extremely long sleep), rapid screenshot exfiltration to Frankfurt-based infrastructure, and DPAPI decryption to harvest credentials, likely dropping info-stealers such as Redline or LummaStealer.