Cybersecurity researchers have discovered GitHub repositories with instructions to install cracked software that contains the RisePro infostealer payload. The malicious repositories used green Unicode circles in the “README.md” file to mimic GitHub’s use of green or red circles to display the status of automatic builds to portray a sense of legitimacy. Each repository pointed to a download link at “digitalxnetwork[.]com” which contains a RAR archive prompting victims to input the password indicated in the GitHub README.md file to open it. The RAR file contains an installer that unpacks an executable which injects RisePro malware into either the AppLaunch.exe or RegAsm.exe process on the victim’s machine. The RisePro infostealer is written in C++ and exfiltrates sensitive data from infected hosts to Telegram channels controlled by the attacker. It is noted that stealer malware has become increasingly popular and can be the primary vector for a ransomware attack. Other infostealers observed recently include RedLine, Vidar, and Raccoon. The vector of the RisePro compromise serves as a reminder for organizations to educate employees on the risks of downloading unapproved software and to limit software installation privileges to IT admins. CTIX analysts also recommend that organizations block the malicious site identified in this attack: “digitalxnetwork[.]com”. CTIX analysts will continue to report on malware trends and novel malware delivery campaigns.