The campaign abused a trusted developer platform as both lure surface and payload infrastructure. ADLab describes repositories and archive names crafted around high-demand software and AI-tool themes. A victim who downloaded and launched a malicious archive could start a loader that retrieved later-stage material from attacker-controlled infrastructure,…
Inspect the ClaimsCase · DiggingBeagle record
GitHub malware campaign used AI-tool lures and staged payload hosting
Venustech ADLab reported a large malware-distribution campaign that abused GitHub repositories, used popular AI-tool names as download lures, and stored encrypted or obfuscated later-stage payloads on GitHub. The report specifically lists malek733/657/128/01.txt as campaign payload infrastructure. This campaign context is independent of the pinned DiggingBeagle audit of malek733/657, whose deterministic inspection produced zero correlated findings and retained a coverage gap.
Evidence boundary
Campaign-level reconstruction from ADLab reporting. It does not assert that the pinned malek733/657 audit snapshot itself contained or executed the reported payload, and it does not convert the audit's zero-finding machine result into a malware finding.
30-second account
The report shows how AI-tool popularity can be exploited as social-engineering cover without requiring a vulnerability in the advertised AI products themselves. It also shows how public code hosting can become part of staged malware infrastructure and, in at least one analyzed sample, coexist with blockchain-based C2 discovery.
Read the stated implicationsThe public report does not establish a complete victim count, realized financial loss, or a named threat actor. The report does not establish that every campaign sample used Polygon or another blockchain-based C2 mechanism. The pinned DiggingBeagle malek733/657 audit cannot establish whether its skipped or extraction-failed surface was the same 128/01.txt…
Inspect limits and uncertaintyFull canonical reconstruction
The campaign abused a trusted developer platform as both lure surface and payload infrastructure. ADLab describes repositories and archive names crafted around high-demand software and AI-tool themes. A victim who downloaded and launched a malicious archive could start a loader that retrieved later-stage material from attacker-controlled infrastructure, including GitHub raw content. The report lists malek733/657/128/01.txt among those later-stage payload locations. In a separately analyzed campaign sample, the loader used Polygon blockchain infrastructure to resolve a later C2 address before requesting tasks and downloading another encrypted GitHub-hosted payload. These are campaign-level findings from the external report; they do not establish what the pinned DiggingBeagle malek733/657 snapshot contained because that audit had a skipped file and an extraction error.
Mechanism and trust boundary
- 01
Publish or disguise malicious repositories and archives
Attackers use GitHub accounts and repositories that resemble normal developer projects and advertise high-interest software or AI-tool downloads.
Boundary: public code-hosting surface / user trust
- 02
Induce the user to download and run the archive
The campaign uses search visibility, familiar project names and software-version naming to encourage execution.
Boundary: repository content / local execution
- 03
Resolve task or C2 infrastructure
In the analyzed sample, the loader contacts initial infrastructure and uses a Polygon smart-contract query to recover a later C2 address.
Boundary: infected host / attacker control infrastructure
- 04
Retrieve a staged payload from GitHub
Later-stage content is hosted under ordinary file extensions on GitHub; the report specifically lists malek733/657/128/01.txt as one such location.
Boundary: trusted hosting platform / attacker-controlled payload
- 05
Decrypt or deobfuscate and execute
The loader processes the retrieved payload locally and executes the resulting code, including memory-loaded or interpreter-driven stages in the documented campaign.
Boundary: downloaded data / executable behavior
Typed chronology
Dates retain their recorded precision. Partially dated events can overlap; display order does not establish a causal sequence.
- 2025-03 (month precision)occurrence
ADLab dates the campaign's early activity to March 2025
ADLab describes the campaign as beginning with smaller-scale activity before later growth.
- 2026-03 (month precision)occurrence
Reported campaign volume reaches a monthly peak
ADLab reports more than 1,000 newly observed malicious samples during March 2026.
- Apr 19, 2026Event type unspecified
ADLab campaign analysis is published
The report documents GitHub-hosted lures, staged payload hosting, malicious-account infrastructure and a sample chain using Polygon to recover a C2 address.
- Apr 19, 2026disclosure
Public disclosure
Claims & evidence
5 independently addressable Claims. Expand a Claim to inspect support, contradiction and scope.
CLM-ADLAB-AI-LURESADLab reported that the campaign used filenames and repository themes imitating popular AI and automation tools, including OpenClaw-, Claude Code-, Gemini-, DeepSeek-, Qwen-, and Sora-themed downloads, to attract users.supported
Basis: reported finding
- supportsFrom Open-Source Repositories to On-Chain C2: Analysis of a Large-Scale Attack Campaign Exploiting GitHub and AI Trendssecondary reporting
Section 2.1 attack-technique analysis and Section 2.2 Table 1, AI/automation lure examples
CLM-ADLAB-CHAIN-C2In one analyzed campaign sample, ADLab reported that malware queried Polygon blockchain infrastructure to obtain a later C2 address before requesting tasks and retrieving another encrypted payload from GitHub.supported
Basis: reported finding
- supportsFrom Open-Source Repositories to On-Chain C2: Analysis of a Large-Scale Attack Campaign Exploiting GitHub and AI Trendssecondary reporting
Attack-case analysis, figures and text covering the Polygon smart-contract request, returned C2 address, task request, and GitHub payload retrieval
CLM-ADLAB-MALEK733-PAYLOADADLab listed https://github.com/malek733/657/raw/refs/heads/main/128/01.txt as one of the campaign's next-stage payload storage locations.supported
Basis: reported finding
- supportsFrom Open-Source Repositories to On-Chain C2: Analysis of a Large-Scale Attack Campaign Exploiting GitHub and AI Trendssecondary reporting
Section 2.2, Table 2, next-stage payload storage addresses
CLM-ADLAB-STAGED-EXECUTIONADLab described later-stage payloads hosted in ordinary-looking GitHub files, including txt, html, css, js, json and log files, as encrypted or heavily obfuscated content that the loader decrypted or deobfuscated before execution.supported
Basis: reported finding
- supportsFrom Open-Source Repositories to On-Chain C2: Analysis of a Large-Scale Attack Campaign Exploiting GitHub and AI Trendssecondary reporting
Section 2.1 staged-payload description and text immediately following Section 2.2 Table 2
CLM-ADLAB-GH-CAMPAIGN-SCALEADLab reported that the GitHub-hosted malware campaign had been active since March 2025, had accumulated more than 2,700 malicious archive samples, and exceeded 1,000 newly observed malicious samples in March 2026.supported
Basis: reported finding
- supportsFrom Open-Source Repositories to On-Chain C2: Analysis of a Large-Scale Attack Campaign Exploiting GitHub and AI Trendssecondary reporting
Overview, paragraphs describing campaign start, cumulative sample count, and the March 2026 peak
Implications within the documented scope
The report shows how AI-tool popularity can be exploited as social-engineering cover without requiring a vulnerability in the advertised AI products themselves. It also shows how public code hosting can become part of staged malware infrastructure and, in at least one analyzed sample, coexist with blockchain-based C2 discovery.
Controls and mitigations
- Treat GitHub repositories advertising cracked, premium, security, cryptocurrency or AI-tool bundles as untrusted software until publisher and release provenance are verified.
- Prefer signed vendor releases or package-manager provenance over executable archives linked from newly created or low-history repositories.
- Monitor endpoints for execution chains that combine archive extraction, script interpreters, raw.githubusercontent.com downloads and immediate outbound C2 traffic.
- For platform or enterprise controls, flag clusters of newly created repositories that reuse lure naming patterns and host opaque payload-like files under ordinary text or web extensions.
Unknowns and contradictions
- The public report does not establish a complete victim count, realized financial loss, or a named threat actor.
- The report does not establish that every campaign sample used Polygon or another blockchain-based C2 mechanism.
- The pinned DiggingBeagle malek733/657 audit cannot establish whether its skipped or extraction-failed surface was the same 128/01.txt payload named by ADLab without successful reacquisition and inspection of that exact commit.
Sources and citation
Material revision history
- Sep 25, 2026 · Published version · first publication · revision 48
Cite this record
DiggingBeagle. “GitHub malware campaign used AI-tool lures and staged payload hosting.” Published by DiggingBeagle Sep 25, 2026 · Public disclosure Apr 19, 2026. https://diggingbeagle.com/cases/github-malware-campaign-used-ai-tool-lures-and-staged-payload-hosting/
Citation guidance