📡 DarkBlinders campaign uses fake meeting client and GitHub C2

DarkBlinders ran a cyberespionage campaign from August to October 2026 against targets in Israel and Iraq’s Kurdistan Region, using the fake StarkMeet app, webmail impersonation, and fake cloud-sharing pages. Confirmed compromises included a Kurdish government cloud environment and an Israeli security-linked individual, with credential theft and at least 1 GB of data exfiltrated.

The installer also deployed a persistent loader under RuntimeBroker paths. The malware used GitHub for host registration, selective second-stage tasking, and command retrieval every 63 seconds, while executing PowerShell via an internal runspace rather than powershell.exe to reduce detection.

🛰️ Open sources - closed narratives
@sitreports