Cyber Threats: Hackers Exploit GitHub for Amadey Malware Distribution

TL;DR

Cybercriminals are utilizing public GitHub repositories to disseminate Amadey malware and other data stealers, evading web filters and simplifying their operations. This tactic, observed in April 2025, highlights the evolving strategies of threat actors in bypassing security measures.

Introduction

Cybersecurity experts have uncovered a sophisticated campaign where threat actors are exploiting public GitHub repositories to host and distribute malicious payloads, including Amadey malware. This strategy, observed in April 2025, allows hackers to bypass web filters and streamline their malicious activities.

Malware Distribution via GitHub

Researchers from Cisco Talos, Chris Neal and Craig Jackson, revealed that malware-as-a-service (MaaS) operators are utilizing fake GitHub accounts to host payloads, tools, and Amadey plug-ins. This method is likely employed to circumvent web filtering and enhance ease of use for the attackers¹.

Key Findings

• Malicious Repositories: Hackers are creating public repositories on GitHub to store malicious files.
• Amadey Malware: The primary payload observed in this campaign is Amadey, a versatile malware known for its data-stealing capabilities.
• Bypassing Filters: By hosting malicious content on GitHub, attackers can evade traditional web filtering mechanisms, making detection more challenging.

Implications for Cybersecurity

This tactic underscores the need for enhanced vigilance and advanced security measures. Organizations must adapt to these evolving threats by implementing robust monitoring and detection systems.

Conclusion

The use of GitHub repositories to distribute malware highlights the adaptability of cybercriminals. As threat actors continue to find innovative ways to bypass security measures, it is crucial for cybersecurity professionals to stay informed and proactive in their defense strategies.

References

1. Cisco Talos, (2025). “Hackers Use GitHub Repositories to Host Amadey Malware and Data Stealers, Bypassing Filters”. Cisco Talos. Retrieved 2025-07-17. ↩︎