New Malvertising Campaign Exploits GitHub Repositories to Distribute Malware

A sophisticated malvertising campaign has been uncovered that targets unsuspecting users through dangling commits in legitimate GitHub repositories, injecting promotional content for a counterfeit GitHub Desktop installer into popular development and open-source projects. When users download what appears to be the genuine client, the installer quietly delivers malicious payloads in the background, compromising systems without raising immediate suspicion, according to Unit42_Intel.

Victims clicking malvertising banners were redirected to compromised pages offering an updated GitHub Desktop client build, but these pages served a dropper masquerading as “GitHubDesktopSetup-x64.exe.” Execution of the dropper triggers a multi-stage process: it launches a Windows Script Host script, which then executes PowerShell commands to load and run a malicious DLL

payload via svchost.exe, establishing persistent communication with a command-and-control server for remote code execution, data exfiltration, and potential lateral movement within enterprise environments. Researchers note the attackers used obfuscation and legitimate process names, with techniques such as scheduled tasks for persistence and svchost.exe for cloaked execution, underscoring the need for strict software-source validation and vigilant monitoring after downloads.