Stargazers Ghost Network

The Stargazers Ghost Network, identified by Check Point Research (CPR), is a malicious network of GitHub accounts that distribute malware and harmful links through phishing repositories. The network has been operating since at least August 2022, but its first public advertisement occurred in July 2023. This group uses multiple GitHub accounts to star and verify a malicious repository, thereby enhancing its perceived legitimacy. Most repositories on the Stargazers Ghost Network use tags that ensure they appear at the top of GitHub searches, making them more likely to be clicked on by unsuspecting users. The Stargazers Ghost Network has successfully distributed a variety of malware families, including Atlantida Stealer, Rhadamanthys infostealer, RisePro, Redline, and Lumma Stealer. The network operates as a Distribution-as-a-Service (DaaS) system, charging for services such as starring a repository with numerous accounts or providing an account with an aged repository, which is generally more trusted than a new one. This unique approach to malware distribution has marked a new era in cybercrime, where malicious repositories are made to appear legitimate through organic activity like starring and forking. Despite actions taken by GitHub to disrupt their operations, the Stargazers Ghost Network has managed to minimize their losses by distributing activities across different profiles and accounts. As a result, usually only one part of their operation is disrupted instead of all involved accounts. The network's campaigns have proven extremely successful, with total estimated profits around $100,000 since it started operating publicly in July 2023. With its innovative and effective strategies, the Stargazers Ghost Network represents a significant threat in the landscape of cybercrime.