A new malware campaign has been quietly spreading through fake GitHub repositories. Tracked internally as TroyDen's Lure Factory, the campaign uses a custom LuaJIT trojan that is carefully made to get past automated security tools. The attack is based on a GitHub repository that looks like a Docker deployment tool for the real OpenClaw AI project.
Researchers found the campaign after finding a trojanized package that used behavioral evasion techniques to get around automated analysis pipelines. Their investigation found the same malicious toolchain running across more than 300 confirmed delivery packages—gaming cheats, phone trackers, VPN crackers, and Roblox scripts—all hosted in different GitHub repositories and all connecting back to the same attacker's infrastructure.
As soon as the execution starts, every victim machine is geolocated, and a full desktop screenshot is taken and sent to a C2 server in Frankfurt, Germany. The payload then takes a picture of the whole desktop and sends it to the Frankfurt C2 server using a hardcoded multipart POST. The C2 boundary string, which is a fixed 38-character value that appears in every request, suggests that the operator used AI to help them write the code for the server-side panel.
If you downloaded packages from one of the three affected repositories, you should assume your machine has been hacked and look for signs of unauthorized access. Security teams should treat any GitHub download that pairs a renamed interpreter with a file that is not clear as a high-priority case.
The published IOCs should be put into EDR and network monitoring tools right away. The firewall should block all outgoing connections to the confirmed C2 IP addresses. You can read the whole report from Netskope here and get live updates on the story on CNN.com and CNN Tech.
