
A threat actor known as Stargazer Goblin has made $100,000 in illicit profits over the past year by creating a network of fake GitHub accounts and operating a Distribution-as-a-Service (DaaS) operation distributing a variety of information-stealing malware.
Check Point said the network, which consists of more than 3,000 accounts on a cloud-based code-hosting platform, spans thousands of repositories used to share malicious links and malware, and which the company has dubbed the “Stargazers Ghost Network.”
Malware families spread using this method include Atlantida Stealer, Rhadamanthys, RisePro, Lumma Stealer, and RedLine, and the fake accounts also star, fork, watch, and subscribe to malicious repositories in an attempt to appear legitimate.
The network is believed to have been active in some preliminary form since August 2022, but the DaaS advertisements were not discovered in the dark until early July 2023.
“The threat actor currently operates a network of ‘ghost’ accounts distributing malware via malicious links on repositories and encrypted archives as releases,” security researcher Antonis Telefos explained in an analysis published last week.
“In addition to distributing malware, this network also serves a variety of other activities that make these ‘ghost’ accounts appear as regular users, lending false legitimacy to its operations and associated repositories.”
Different categories of GitHub accounts are responsible for different aspects of this scheme in order to make their infrastructure more resilient against GitHub’s takedown efforts when malicious payloads are flagged on the platform.

These include accounts providing phishing repository templates, accounts providing images of phishing templates, and accounts pushing malware to repositories in the form of password-protected archives disguised as cracked software or game cheats.
If the third set of accounts is detected and banned by GitHub, Stargazer Goblin will update the first account’s phishing repository with new links to the new active malicious release, allowing the operators to move forward with minimal disruption.
Besides “liking” new releases from multiple repositories and committing changes to the README.md file to change the download links, there is evidence that some accounts on the network were previously compromised and their credentials were likely obtained by credential stealing malware.
“In most cases, repository and stargazer accounts are not affected by bans or repository removals, whereas commit and release accounts are typically banned as soon as a malicious repository is detected,” Telefos said.
“It is common for link repositories to contain links to banned release repositories. When this occurs, the commit account associated with the link repository will update the malicious link with a new link.”
One of the campaigns discovered by Check Point uses a malicious link to a GitHub repository that points to a PHP script hosted on a WordPress site, delivering an HTML Application (HTA) file and ultimately executing the Atlantida Stealer via a PowerShell script.
Other malware families spread via DaaS include Lumma Stealer, RedLine Stealer, Rhadamanthys, and RisePro. Additionally, Check Point noted that the GitHub account is part of a larger DaaS solution that operates similar ghost accounts on other platforms, including Discord, Facebook, Instagram, X, and YouTube.

“Stargazer Goblin created an extremely sophisticated malware distribution operation that allowed them to avoid detection because GitHub was perceived as a legitimate website, avoid suspicion of malicious activity, and recover with minimal damage when GitHub disrupted their network,” Telefos said.
“By utilizing multiple accounts and profiles performing a variety of activities, from starring to hosting repositories, committing phishing templates, and hosting malicious releases, the Stargazers Ghost Network is able to minimize losses if GitHub takes action to disrupt its operations, as typically only a portion of its overall operations are disrupted, rather than all accounts involved.”
The development comes as unknown threat actors have been targeting GitHub repositories, wiping their contents and asking victims to contact a user named Gitloker on Telegram as part of a new extortion campaign that has been ongoing since February 2024.
The social engineering attack targets developers with phishing emails sent from “notifications@github.com” and tricks them into clicking a fake link disguised as a job posting on GitHub, then authorizing a new OAuth app that wipes all of their repositories and requires payment in exchange for restoring access.
This also follows an advisory from Truffle Security that sensitive data may be accessible through deleted forks, deleted repositories, and even private repositories on GitHub, urging organizations to take steps to protect against so-called “Cross-Fork Object Reference (CFOR)” vulnerabilities.
“CFOR vulnerabilities arise when one repository fork is able to access sensitive data from another fork, including data from private or deleted forks,” says Joe Leon. “Similar to insecure direct object references, in CFOR users provide commit hashes to directly access commit data that they would not otherwise be able to see.”
This means that code committed to a public repository will be accessible forever as long as at least one fork of that repository exists, and additionally, code committed between the creation of internal forks and the time the repository is made public will be accessible.
However, it’s worth noting that these are intentional design decisions made by GitHub, as GitHub states in its documentation:
- Commits to any repository in a fork network are accessible from any repository in the same fork network, including the upstream repository.
- When you change a private repository to public, all commits in that repository become visible to all users, including commits made in forks of it.
“The average user sees the separation of private and public repositories as a security boundary, and naturally assumes that data in a private repository is not accessible to public users,” Leong said.
“Unfortunately, (…) that is not necessarily true. Moreover, the act of deletion implies data destruction. As we saw above, deleting a repository or a fork does not actually delete the commit data.”