Clever 'GitHub Scanner' campaign abusing repos to push malware

A phishing campaign is abusing GitHub Issues to trigger legitimate GitHub notification emails that lure repository contributors to a fake domain (github-scanner[.]com). The site uses a bogus captcha and JavaScript clipboard tricks to get victims to paste a PowerShell command into Windows Run, which downloads and executes a trojan (l6E.exe / SysSetup.exe) identified as the Lumma Stealer information-stealing malware; the malware can harvest browser credentials, cookies, history, cryptocurrency wallets, and files. Multiple suspicious callback domains and a VirusTotal sample are noted, and users are advised to avoid links in such notifications and report the issues to GitHub.