Stargazers Ghost Network

Description

Check Point Research identified a sophisticated network of GitHub accounts distributing malware through malicious repositories. The Stargazers Ghost Network consists of different types of accounts performing various actions like starring, forking, and subscribing to give an appearance of legitimacy. This network functions as a Distribution as a Service (DaaS), allowing threat actors to share malicious content. The operator, tracked as Stargazer Goblin, provides and maintains the network, distributing malware families like Atlantida Stealer, Rhadamanthys, Lumma Stealer, and RedLine. With over 3,000 active Ghost accounts, the network has earned an estimated $100,000 since its inception in August 2022. This new era of malware distribution utilizes ghost accounts across platforms, potentially employing AI for targeted campaigns.