Flying Under the Radar: Abusing GitHub for Malicious Infrastructure

Recorded Future Insikt Group research describes how cybercriminals and APTs increasingly abuse GitHub and other legitimate code-hosting services for payload delivery, dead-drop resolving, full C2, exfiltration, phishing, and repository poisoning — a trend termed "living-off-trusted-sites" (LOTS). The report notes observed samples (March–November 2023), recommends short-term blocking/flagging of known-abused GitHub services, and urges longer-term investment in visibility, diverse detection approaches, and platform-level mitigations from legitimate internet services.