GitHub comments abused to push password stealing malware masked as fixes

A widespread campaign has been abusing GitHub issue comments to post fake "fixes" that link to password-protected archives (password: "changeme") hosting an executable identified as the Lumma Stealer info-stealer. The malware harvests browser credentials, cookies, credit cards, and cryptocurrency wallets/private keys, bundles the data, and exfiltrates it to attackers; researchers observed thousands of comments (reported ~29,000 over three days) across many projects and provided indicators and remediation advice.