GitHub Impersonation Deploys Information Stealer

Arctic Wolf identified and removed a malicious GitHub impersonation campaign that hosted fake vendor repositories (including an Arctic Wolf impersonator) linking to ZIP downloads which contained a trojanized executable that side-loaded a malicious libcurl.dll to deploy the BoryptGrab information-stealer; investigators found nearly 300 similar repositories impersonating multiple security vendors and have published IOCs and enhanced detections.