Hackers Using Cracked Software on GitHub to Spread RisePro Info Stealer

Researchers discovered 17 GitHub repositories (11 accounts) offering cracked software that link to password-protected RAR archives on digitalxnetwork.com which install a loader that injects the RisePro (v1.6) information stealer into legitimate binaries (AppLaunch.exe or RegAsm.exe); the campaign uses evasion techniques (inflated executables to disrupt analysis) and exfiltrates stolen data to Telegram channels, and Microsoft/G DATA have taken the repositories down.