GitHub Used as Covert Channel in Multi-Stage Malware Campaign

Malicious LNK files targeting users in South Korea use a multi-stage, living-off-the-land campaign that embeds encoded payloads and PowerShell scripts (retrieved from or communicating with GitHub) to execute silently, drop decoy PDFs, establish persistence via scheduled tasks, and exfiltrate system information; recent variants reduce metadata and embed decoding to evade detection.