GitHub Abused by Kimsuky Hackers Delivering Malware Through LNK Files

GBHackers reports that GitHub is being abused by the North Korea-backed APT group Kimsuky, which is described as exploiting GitHub repositories to deliver malware via weaponized LNK files. According to S2W’s Threat Intelligence Center, TALON, the campaign uses a malicious ZIP archive named “NTS_Attach.zip” containing a LNK file disguised as an electronic tax invoice PDF, which triggers a PowerShell command to download and execute additional scripts from attacker-controlled GitHub repositories.

The primary payload, main.ps1, connects to a GitHub-hosted path to download decoy documents and other malicious components, with hardcoded GitHub Private Tokens embedded directly within the scripts to access private repositories. Investigators found nine private repositories linked to the campaign, including group_0717, group_0721, test, hometax, group_0803, group_0805, group_0811, fsc_doc, and repayment, and the attacker’s Gmail address was identified in the GitHub account creation.

The campaign also employs a multi-stage persistence mechanism, creating MicrosoftEdgeUpdate.ps1 in %AppData% and a scheduled task named BitLocker MDM policy Refresh{DBHDFE12-496SDF-Q48D-SDEF-1865BCAD7E00} to run every 30 minutes, enabling ongoing communication with the C2 infrastructure.