Unveiling of a large resilient infrastructure distributing information stealers

SEKOIA.IO uncovered and documented a resilient, multi-stage distribution infrastructure—over 250 domains and dozens of redirect hosts—that lures victims with SEO-poisoned cracked-software pages to download password-protected RAR archives hosted on abused GitHub accounts; those archives contain Raccoon and Vidar infostealers employing commercial packers and sandbox/defense-evasion techniques. The report provides extensive IoCs (domains, redirect patterns, IPs, GitHub accounts, sample hashes), analysis of payload evasion, and MITRE ATT&CK mappings to aid detection and hunting.