A sophisticated phishing campaign linked to North Korean threat actors is abusing GitHub as a covert command-and-control (C2) channel. The attackers leverage malicious Windows shortcut files (LNK) to execute multi-stage payloads while blending malicious traffic with trusted platform communications.
This GitHub C2 LNK phishing attack is particularly dangerous because many organizations whitelist GitHub traffic, allowing malicious communication to bypass traditional perimeter defenses.
Researchers identified the campaign targeting organizations in South Korea, using carefully crafted decoy documents to deliver malware and maintain persistent surveillance. The attack demonstrates how trusted cloud platforms are increasingly weaponized for stealthy cyber operations.
In this guide, you’ll learn:
- How the GitHub C2 LNK phishing attack works
- Attack chain and technical breakdown
- Threat actor tactics and attribution
- Detection indicators
- Mitigation and prevention strategies
What Is the GitHub C2 LNK Phishing Attack? 
The campaign uses:
- Windows LNK shortcut files
- Embedded PowerShell scripts
- Decoy PDF documents
- GitHub repositories as C2 infrastructure
Victims believe they are opening legitimate documents, but the LNK file silently executes malicious code.
Threat Actor Attribution 
Researchers link the activity to North Korean state-sponsored groups, including:
- Kimsuky
- APT37
- Lazarus Group
These groups typically focus on:
- Intelligence gathering
- Strategic surveillance
- Economic espionage
- Long-term persistence
Why GitHub as C2 Is So Effective 
Using GitHub provides attackers with:
- Trusted domain reputation
- HTTPS encrypted traffic
- Whitelisted corporate access
- Easy data storage and retrieval
This allows malicious traffic to blend with legitimate developer activity.
Multi-Stage Infection Chain Explained 
Step 1: Phishing Delivery
Victim receives:
- Email attachment
- LNK file disguised as PDF
- Business-themed lure
Example file names:
- Strategic proposals
- Partnership agreements
- Confidential documents
Step 2: LNK Execution
Opening the file triggers:
- Hidden PowerShell command
- XOR decoding function
- Extraction of payload
The user sees a decoy PDF while malware executes.
Step 3: Environment Checks
The script checks for:
- Virtual machines
- Debuggers
- Security tools
- Sandboxes
If detected, execution stops to avoid analysis.
Step 4: Persistence Mechanism
The malware:
- Drops VBScript payload
- Creates scheduled task
- Runs every 30 minutes
This ensures long-term access.
Step 5: Data Collection
The script gathers:
- OS version
- Boot time
- Running processes
- System details
This intelligence is uploaded to GitHub.
Step 6: GitHub Command-and-Control
The malware:
- Sends data to private repository
- Pulls new commands
- Maintains keep-alive communication
All traffic uses encrypted HTTPS.
Campaign Evolution 
Earlier versions:
- Less obfuscation
- Metadata exposure
- Linked to XenoRAT
Newer variants:
- Embedded decoding functions
- Encoded payload inside LNK
- Improved stealth techniques
Persistence and Surveillance Goals
Attackers aim for:
- Long-term monitoring
- Data exfiltration
- Intelligence collection
- Follow-on attacks
Scheduled tasks execute every 30 minutes to maintain access.
Detection Indicators (IOCs) 
Security teams should monitor for:
Suspicious File Types
- .pdf.lnk attachments
- Double-extension files
Script Execution
- Unexpected PowerShell usage
- VBScript execution
- XOR decoding behavior
Persistence Mechanisms
- Scheduled tasks running every 30 minutes
- Unknown startup entries
Network Activity
- GitHub API calls from non-developer systems
- Unexpected outbound GitHub traffic
Risk Impact Analysis 
Organizational Risks
- Corporate espionage
- Intellectual property theft
- Credential harvesting
- Internal network reconnaissance
Security Risks
- Long-term persistence
- Detection evasion
- Trusted domain abuse
Immediate Mitigation Steps 
1. Block Suspicious LNK Files
Filter:
- .lnk attachments
- Double-extension files
2. Monitor PowerShell Activity
Alert on:
- Encoded commands
- Hidden execution flags
3. Audit Scheduled Tasks
Look for:
- Unknown tasks
- 30-minute intervals
4. Inspect GitHub Traffic
Investigate:
- GitHub API connections
- Unexpected repositories
5. User Awareness Training
Educate users to:
- Avoid opening unknown attachments
- Verify document authenticity
Long-Term Prevention Best Practices 
Implement Zero Trust Email Security
- Attachment sandboxing
- URL rewriting
- Threat intelligence integration
Restrict Script Execution
- PowerShell logging
- Script block monitoring
- Constrained language mode
Network Monitoring
- Detect anomalous GitHub traffic
- DNS logging
- TLS inspection (where appropriate)
Endpoint Detection and Response
Deploy EDR to detect:
- Scheduled task creation
- Script-based persistence
- LNK execution anomalies
Mapping to Security Frameworks 
MITRE ATT&CK Techniques
- T1566 — Phishing
- T1059 — Command execution
- T1053 — Scheduled task persistence
- T1071 — Application layer protocol
- T1105 — Ingress tool transfer
Common Mistakes Organizations Make 
- Whitelisting GitHub without monitoring
- Ignoring LNK file risks
- Not logging PowerShell activity
- Lack of endpoint visibility
- No scheduled task monitoring
Key Takeaways 
- North Korea-linked actors abuse GitHub as C2
- LNK files used for stealth phishing
- Decoy PDFs hide malicious execution
- Scheduled tasks maintain persistence
- Trusted domains enable detection evasion
- Monitoring GitHub traffic is critical
FAQs 
What is the GitHub C2 phishing attack?
It is a campaign using malicious LNK files and GitHub repositories for command-and-control communication.
Why do attackers use GitHub?
Because it is trusted, encrypted, and often whitelisted in corporate environments.
What happens when the LNK file is opened?
It executes PowerShell scripts that deploy malware and display a decoy document.
How does the malware maintain persistence?
By creating scheduled tasks that run every 30 minutes.
How can organizations detect this attack?
Monitor PowerShell activity, scheduled tasks, and unusual GitHub API traffic.
Conclusion
This GitHub C2 LNK phishing campaign highlights a growing trend: attackers abusing trusted platforms to evade detection. By combining LNK-based execution, PowerShell scripting, and GitHub-hosted command infrastructure, threat actors achieve stealthy, long-term access.
Organizations must:
- Monitor trusted domain traffic
- Restrict script execution
- Train users on phishing risks
- Deploy endpoint detection
Trusted platforms can no longer be blindly whitelisted. Continuous monitoring is essential to stop modern stealth attacks.
