New CGrabber and Direct-Sys Malware Spread Through GitHub ZIP Files

Cyderes researchers uncovered a sophisticated multi-stage malware campaign delivered via GitHub-hosted ZIP archives that leverages DLL sideloading to launch a Direct-Sys Loader which evades analysis (including direct syscalls and VM/sandbox checks) and then deploys the CGrabber Stealer to harvest browser credentials, credit cards, cookies, private keys from 150+ crypto apps, and data from messaging and VPN clients; stolen data is ChaCha20-encrypted and the malware avoids systems in Commonwealth of Independent States countries.