Stargazer Goblin: Massive "Ghost Network" of 3,000 GitHub Accounts Fueling Malware Distribution-as-a-Service

Executive Summary\n\nResearchers from Check Point and Foresiet have recently uncovered a highly resilient and automated malware distribution network dubbed the "Stargazers Ghost Network." Operated by a threat group identified as Stargazer Goblin, this operation utilizes over 3,000 inauthentic or "ghost" GitHub accounts to facilitate a sophisticated Distribution-as-a-Service (DaaS) model. Active since at least August 2022, the network has significantly scaled its operations as of July 2026, generating an estimated $100,000 in illicit profits by acting as a delivery conduit for various high-profile information-stealing malware families.\n\n## Threat Analysis\n\nStargazer Goblin represents a shift in how cybercriminals leverage legitimate cloud-hosting platforms. Unlike traditional phishing campaigns that host malicious files on temporary domains, the Stargazers Ghost Network exploits the inherent trust associated with GitHub. The group provides other threat actors with an end-to-end distribution solution. Their primary monetization method involves selling "slots" or services to malware developers who want their payloads (such as Lumma Stealer or Rhadamanthys) delivered to unsuspecting victims. By manipulating repository metrics like "stars" and "forks" using their vast botnet of ghost accounts, they create a veneer of popularity and security for their malicious repositories, tricking developers and enthusiasts looking for cracked software or game cheats.\n\n## Technical Details\n\nThe technical architecture of the network is categorized into specific functional roles for each GitHub account. "Phishing accounts" host the repository templates and initial download links; "Image accounts" provide the visual assets to make the repositories look professional; and "Malware accounts" serve the actual payloads as password-protected releases to evade GitHub’s automated security scanning. The group uses advanced automation to replace suspended accounts and broken links almost instantly, ensuring continuous uptime. When a payload account is flagged and removed, the script-driven network automatically updates the primary phishing link to point to a new "live" account. This compartmentalization makes the network extremely difficult to dismantle through standard take-down requests. The malware delivered often includes password-protected ZIP archives containing heavily obfuscated loaders for infostealers.\n\n## Attribution Assessment\n\nIntelligence analysts have assigned high confidence to the assessment that Stargazer Goblin is a financially motivated cybercriminal syndicate. While no direct link to a specific nation-state has been established, the group's advertisements on underground forums are primarily in Russian, and their operational windows align with Eastern European time zones. The group’s "service-oriented" business model is typical of the modern Eastern European cybercrime ecosystem, where specialized groups focus on a single niche—in this case, distribution—rather than the full attack chain.\n\n## Implications\n\nThe success of Stargazer Goblin highlights a growing trend of "reputation manipulation" as an attack vector. By weaponizing the social features of development platforms, threat actors bypass the skepticism usually applied to unknown download links. This poses a significant risk to the software supply chain and the open-source community, as legitimate developers may find it increasingly difficult to distinguish between popular, safe projects and orchestrated malicious campaigns. It also places immense pressure on platform providers to enhance their bot detection and reputation scoring algorithms.\n\n## Recommendations\n\nTo mitigate risks associated with the Stargazers Ghost Network, Encrygma recommends the following: 1. Implement strict organizational policies against downloading and executing software from unverified or "starred" GitHub repositories without internal code review. 2. Use advanced endpoint protection (EDR) to monitor for unauthorized execution of scripts and password-protected archives. 3. Monitor network traffic for connections to known GitHub-hosted C2 loaders. 4. Organizations should leverage threat intelligence feeds to blacklist GitHub accounts and repositories identified as part of the Ghost Network. 5. Educate employees on the dangers of "cracked" software lures and the fake legitimacy provided by social metrics on platforms like GitHub and Discord.