Stargazers Ghost Network

The Stargazers Ghost Network, a malicious threat actor identified by Check Point Research, has been using GitHub accounts to distribute malware or malicious links through phishing repositories. This group operates and maintains the network, employing a novel technique that enhances the perceived legitimacy of their malicious activities. The group uses multiple GitHub accounts to "star" and "verify" a malicious repository, creating an illusion of authenticity which can deceive users into interacting with harmful content. Throughout September and October 2024, the Stargazers Ghost Network distributed GodLoader, a malicious loader, using this innovative method. The network operates as a Distribution-as-a-Service (DaaS), enabling the seemingly legitimate distribution of malware through GitHub repositories. The group's campaigns have shown high infection rates, demonstrating the effectiveness of this new method for gaining initial access. The network had previously distributed the same archive in campaigns on September 12, September 14, and September 29, 2024. The Stargazers Ghost Network has been active since at least August 2022, distributing various malware families including Atlantida Stealer, Rhadamanthys infostealer, RisePro, Redline, and Lumma Stealer. An advertisement from July 2023 found on a Dark Web forum revealed that the group charges for their services, indicating a commercial motive behind their activities. The group's tactics demonstrate a new era of malware distribution, utilizing organic actions like starring and forking malicious repositories to make them appear legitimate to unsuspecting users.