GitHub comments abused to push malware via Microsoft repo URLs

Researchers observed threat actors abusing GitHub's comment file upload mechanism to host malware (including a LUA loader called SmartLoader and the RedLine infostealer) using URLs that appear to belong to trusted repositories (e.g., Microsoft projects), enabling convincing lures and persistent distribution since the CDN links remain active even if comments are removed.