Threat Actors Increasingly Abusing GitHub for Malicious Purposes

The report describes a growing trend where threat actors abuse GitHub and other legitimate cloud/code hosting services as "living-off-trusted-sites" (LOTS) to host payloads, act as dead-drop resolvers for C2, and sometimes for data exfiltration; it cites examples (rogue Python packages, Drokbk, ShellBox) and notes detection is difficult, recommending a mix of environment-specific detection strategies.