Threat actor Banana Squad exploits GitHub repos in new campaign

ReversingLabs researchers uncovered a campaign by Banana Squad that trojanized at least 67 GitHub repositories by uploading Python projects that visually mimic benign projects but contain hidden backdoors (using long whitespace and layered encodings/encryption). The malicious files retrieve next-stage payloads from domains such as dieserbenni.ru and 1312services.ru; the report provides extensive IOCs (domains, URLs, GitHub repos, and file hashes), analysis of the obfuscation/crypto used, and notes that GitHub removed the identified repositories.