#ParsedReport #CompletenessHigh
31-08-2026

Operation RepoGhost: Exposing a Russian-Linked Malware Campaign Hiding in GitHub’s Open-Source Ecosystem

https://infosecwriteups.com/operation-repoghost-exposing-a-russian-linked-malware-campaign-hiding-in-githubs-open-source-85a5dd6fa01e

Report completeness: High

Actors/Campaigns:
Repoghost

Threats:
Nova_stealer
Countloader
Clickfix_technique
Lumma_stealer
Smartloader
Seo_poisoning_technique
React2shell_vuln

Victims:
Ai, Cybersecurity, Web3, Cryptography, Vulnerability research, Cryptocurrency, Github users, Windows systems, Macos users

Industry:
Entertainment

Geo:
Russian

CVEs:
CVE-2026-41940 [Vulners]
CVSS V3.1: 9.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- cpanel (<86.0.41, <110.0.97, <118.0.63, <124.0.35, <126.0.54)


TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1027, T1027.013, T1036, T1047, T1059.001, T1059.006, T1105, T1140, T1204.002, T1218, have more...

IOCs:
File: 5
IP: 13
Domain: 2
Hash: 6

Soft:
macOS, Discord, Telegram, Steam, Zoom, Claude, Microsoft App-V, Pastebin, NET Reactor, OpenAI, have more...

Crypto:
monero

Algorithms:
zip, base64

Win API:
Popen, RunShellcode, UnpackShellcode

Languages:
powershell, python, golang