A campaign that began on 26 June 2026 impersonated hundreds of legitimate brands on GitHub in order to distribute infostealer malware, routing victims through SEO-optimised search results.

There is no phishing email in this attack chain. The victim initiates the entire sequence themselves by searching for software they actually want.

The mechanics

  1. Repository creation at scale. The attacker creates GitHub repositories and organisation accounts impersonating well-known software brands, complete with plausible README files, logos and documentation.
  2. SEO optimisation. Repository content is engineered around high-intent search terms — "download [product] free", "[product] crack", "[product] latest version". GitHub's strong domain authority means these pages rank quickly.
  3. Search placement. A user searching for the software encounters a github.com result. It looks authoritative because it is on a domain they trust.
  4. Redirect to payload. The repository links to an installer, often on an external host or a GitHub release asset.
  5. Infection. The download delivers an infostealer — families such as Lumma, Vidar, StealC or newer entrants. Frequently the victim receives a working copy of the advertised software too, so nothing appears wrong.

Why hosting on GitHub is so effective

Reputation-based security controls are structurally defeated by this approach:

  • Domain reputation is excellent. github.com is one of the most trusted domains on the internet, and blocklists will not touch it.
  • TLS is valid. No certificate warnings, no browser interstitial.
  • Egress policies allow it. Any organisation with software developers permits GitHub access. Blocking it wholesale is not an option.
  • Users have been trained to trust it. Years of "download from the official GitHub repo" advice has established GitHub as a legitimacy signal in its own right.

The security industry spent a decade teaching people to check the domain. This campaign is a demonstration that the domain check now passes for the attacker.

Part of a broader pattern

SEO poisoning has become one of the dominant distribution channels for commodity malware. In June 2026, infostealer families including Remus, ACRStealer, LummaC2 and Vidar were actively distributed using SEO poisoning and disguised as illegal software, with EXE files and DLL side-loading as the primary infection vectors.

The reason is a simple funnel advantage. Phishing requires the attacker to convince a sceptical recipient to act. Search poisoning intercepts a user who has already decided to download and install something. Intent is pre-existing; the attacker only has to be the top result.

Detection and defence

Application allowlisting

The most complete answer, where the environment permits it. If unapproved executables cannot run, the download is inert. Windows Defender Application Control or AppLocker on managed fleets, and the equivalent on macOS.

Control the software acquisition path

Users search for downloads because getting software through official channels is slow or unclear. Make the sanctioned path easier than the search: a self-service software portal with a broad catalogue and fast approvals removes most of the motivation.

Alert on installer execution from user-writable paths

Executables launched from Downloads, Temp or a user profile directory shortly after browser activity form a high-signal detection with manageable false positive volume in most environments.

Update awareness training

Most programmes cover email phishing thoroughly and search-result risk not at all. Users should know that:

  • A GitHub URL is not a guarantee of legitimacy.
  • Search results, including paid placements, can lead to malicious downloads.
  • Software should come from a vendor's own documented download page, reached by typing the vendor's domain — not by searching for the product name.
  • Cracked or pirated software is an infection vector in essentially every observed case.

Monitor for impersonation of your own brand

If your organisation publishes software, someone may be impersonating you. Periodically search GitHub and the wider web for repositories and pages using your product names and branding, and use GitHub's abuse reporting to have them removed. Your customers are the ones being infected.

The reporting bottleneck

Platform takedowns work, but the asymmetry is severe. Creating hundreds of repositories is scripted and takes minutes. Reporting and removing them is manual and takes days. Until platforms detect coordinated brand impersonation proactively at signup and publish time, the campaigns will keep running — and the practical defence stays on the endpoint.