Researchers at Check Point have identified a threat actor named Stargazer Goblin that has been creating and leveraging Github accounts to distribute malware since at least July 2023. Stargazer Goblin’s Distribution-as-a-Service (DaaS) network is called “Stargazers Ghost Network”, and it uses GitHub repositories to distribute malware to unsuspecting victims. Researchers at Check Point calculate that more than 3,000 active Ghost accounts comprise the DaaS network. An advertisement for the DaaS network was identified on a dark web forum first published July 8, 2023. The majority of malware seen distributed by this network are infostealers, including RedLine, Lumma Stealer, and Atlantida Stealer. The GitHub repositories hosting the malware either promote an archived file that is password protected (to evade scanning by antiviruses) or contain a link to a compromised WordPress site that hosts the malware. The Stargazer Ghost Network separates the roles of GitHub Ghost accounts to provide resilience against takedowns of the malicious repositories. One Ghost account hosts the repository with the malware, one account promotes the repository (through forking, starring, and liking the malware repository), and one account hosts a repository with the link to the malware repository. The malicious repositories use project names and tags that are related to popular interests such as social media, gaming, and cryptocurrency. While GitHub has acted against many of these fake repositories, Check Point finds that over 200 are still currently active. BleepingComputer recommends that users who arrive at a GitHub repository promoted via a secondary source (such as YouTube, Telegram, or social media) should be very cautious about which files they download or links they click. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.