Brian Clark (@deepthoughts10.infosec.exchange.ap.brid.gy)

Threat Insight (@[email protected]) Attached: 2 images Threat actors continue to abuse GitHub to deliver malware, this time: #LummaStealer. We identified GitHub notification emails that kick off the attack chain. Messages are sent when the threat actor, using an actor-controlled account, comments on existing GitHub issues. The comment includes either a link to the actor-controlled domain droplink[.]digital, a Dropbox URL, or a file attached directly to the issue (which creates a link to the file hosted on GitHub). They claim to provide a fix for the reported problem. People who get these emails may include: the issue creator, the repository owner, the issue assignee, or any watchers. The downloaded file is always named “fix.zip”, which contains “x86_64-w64-ranlib.exe” and “msvcp140.dll”. If the executable is run, it launches #Lumma via “msbuild.exe”. The hash of the executable (and therefore the ZIP file) may vary depending on when the Lumma payload was built. Example: File name: fix.zip Retrieved From: hxxps://objects[.]githubusercontent[.]com/github-production-repository-file-5c1aeb/195216627/22101425?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential;=AKIAVCODYLSA53PQK4ZA%2F20250903%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date;=20250903T111859Z&X-Amz-Expires;=300&X-Amz-Signature;=f0cd8226472614321e6b9e3b883bffe0adf9d9255af1207374947ea71d3c8f76&X-Amz-SignedHeaders;=host&response-content-disposition;=attachment%3Bfilename%3Dfix.zip&response-content-type;=application%2Fx-zip-compressed MD5: 4d8730a2f3388d018b7793f03fb79464 SHA1: cbc5b2181854a2672013422e02df9ea35c3c9e1c SHA256: c8af1b27b718508574055b4271adc7246ddf4cec1c50b258d2c4179b19d0c839 Although GitHub has removed some of the malicious comments, the links in the messages remained active as of September 3, including the actor-controlled URLs. On September 2-3 some of the files attached to the issues had random file names and were encrypted. While they contained an executable with the same name, the threat actor did not provide the password for these files so they could not be extracted and lead to any malware installation. https://infosec.exchange/@threatinsight/115141737393452790