Hackers Abusing GitHub to Evade Detection and Control Compromised Hosts

ReversingLabs reports that threat actors are increasingly abusing GitHub features—notably secret Gists and git commit messages—as covert command-and-control channels and dead-drop resolvers. Several malicious PyPI packages masquerading as proxy/network libraries contained Base64-encoded URLs or commit-message payloads that, when decoded, executed commands on infected hosts; the fraudulent packages were removed from PyPI. This technique lets attackers blend malicious C2 traffic with legitimate GitHub activity, complicating detection and response.