GitCaught: Threat Actor Leverages GitHub Repository for Malicious Infrastructure

Recorded Future's Insikt Group uncovered a coordinated cybercriminal campaign in which Russian-speaking actors abused GitHub to host counterfeit installers of legitimate macOS apps (e.g., 1Password, Bartender 5, Pixelmator Pro) to distribute multiple info-stealer malware families (Atomic macOS Stealer/AMOS, Vidar, Lumma, Octo). Analysis revealed a shared command-and-control infrastructure suggesting organized operations; the report warns that trusted developer platforms are being weaponized and recommends organization-wide code review, automated scanning tools, and enhanced monitoring of unauthorized applications.