Over 3,000 GitHub accounts used by malware distribution service

The report describes a large-scale DaaS operation named the 'Stargazers Ghost Network' run by 'Stargazer Goblin', which uses thousands of fake GitHub accounts and compromised WordPress sites to distribute password-protected archives containing info-stealers (e.g., RedLine, Lumma, Atlantida). Check Point observed operational roles for ghost accounts, phishing templates targeting niche audiences, an attack chain using HTA and PowerShell to deploy stealers, ongoing active repositories despite takedowns, and estimated monetization exceeding $100,000.