Malvertising campaign leads to info stealers hosted on GitHub

Microsoft Threat Intelligence identified a widespread malvertising campaign (tracked as Storm-0408) that redirected users of illegal streaming sites through multiple redirectors to payloads hosted on GitHub, Discord, and Dropbox; initial droppers established multi-stage infections that deployed information stealers (including Lumma and Doenerium variants), AutoIT-based loaders, and NetSupport RAT to perform system discovery, browser credential/DPAPI access, and data exfiltration. The report provides a full analysis of the redirection chain and infection stages, extensive IoCs (domains, URLs, IPs, file hashes, certificates), hunting queries for Defender/XDR and Sentinel, and recommended mitigations to detect and block the activity.