19 confirmed repos tied to the same GitHub malware campaign
I documented a broader GitHub malware campaign that appears to include the fraudulent UNICORN-Binance-WebSocket-API repo I wrote about earlier.
At this point I have 19 confirmed repositories that decode to the same C2, share the same staged Windows payload flow, and reuse the same or highly similar utils/ dropper architecture.
The visible patterns also include repeated commit choreography, manipulated-looking stars/forks, and overlapping fork accounts across campaign repos.
Write-up:
https://blog.technopathy.club/nailproxy-space-github-malware-campaign
I am not asking anyone to touch the infrastructure or execute anything. If others want to independently validate additional public samples via static source review and metadata correlation, more confirmation would be useful.