Phishing Campaign Masquerades as Admin Tools on GitHub to Target IT Professionals

Overview of the Threat

In March 2026, the Atos Threat Research Center (TRC) uncovered a highly advanced and resilient malicious campaign designed to compromise enterprise administrators, DevOps engineers, and security analysts. The attackers leveraged fake GitHub repositories that mimicked legitimate administrative utilities, exploiting the trust that IT professionals place in such platforms. By combining social engineering with search engine optimization (SEO) tactics, the campaign aimed to deliver a remote access trojan (RAT) known as EtherRAT to high-value targets.

How the Attack Chain Unfolds

Impersonating Trusted Tools

The attackers created convincing GitHub facades for popular administrative tools, such as network scanners, patch management software, and system monitoring utilities. These repositories included realistic documentation, version histories, and even fake star ratings to appear credible. Unsuspecting victims who searched for these tools via search engines were often redirected to these lookalike pages.

SEO Poisoning as a Gateway

To increase visibility, the threat actors employed aggressive SEO manipulation. They optimized the fake repository pages with relevant keywords, backlinks, and metadata to rank high in search results for terms like "enterprise network tool download" or "DevOps debugger." This ensured that many IT professionals encountered the malicious pages first.

Delivery of EtherRAT

Once a victim accessed the fake GitHub page and downloaded the supposed tool, they executed a payload that installed EtherRAT. This malware is characterized by its high resilience—it uses advanced persistence mechanisms, including Windows registry modifications, scheduled tasks, and polymorphic code to evade antivirus solutions. EtherRAT then establishes command-and-control (C2) channels to exfiltrate sensitive data, such as credentials, system configurations, and internal network maps.

Primary Targets: Why IT Professionals?

The campaign specifically targets high-privilege accounts within organizations: enterprise administrators, DevOps engineers, and security analysts. These individuals have access to critical infrastructure, making them ideal targets for lateral movement and broader compromise. By compromising a single administrator's machine, attackers could potentially pivot to domain controllers, cloud management consoles, and code repositories.

The Role of GitHub Facades

GitHub is widely trusted by the technical community as a legitimate source for open-source and commercial tools. The attackers exploited this trust by creating repositories that closely mirrored the real projects. They even engaged in basic social engineering, such as responding to issues and pull requests to give the illusion of active maintenance. This level of detail made the fake repositories difficult to distinguish from genuine ones, especially for busy professionals.

Detection and Mitigation Strategies

Verification Best Practices

Organizations should implement strict verification processes for any software downloaded from public repositories. Encourage employees to check the official project website, verify the repository owner's history, and compare code signatures. Using internal software repositories or curated lists can reduce reliance on search engine results.

Network and Endpoint Monitoring

Deploy advanced endpoint detection and response (EDR) systems that can identify unusual behavior, such as unauthorized registry modifications or unexpected outbound connections. Network monitoring should flag traffic to known malicious IPs or domains associated with EtherRAT. Regular vulnerability scanning and patch management are also critical.

User Awareness Training

Conduct regular security awareness sessions focusing on recognizing phishing attempts, fake download links, and the importance of verifying sources. IT teams should be especially cautious when searching for administrative tools via search engines, as these campaigns thrive on SEO manipulation.

Conclusion

The EtherRAT campaign represents a growing trend where attackers combine platform trust with SEO tricks to target high-value professionals. As malicious actors become more sophisticated in mimicking legitimate services, defenders must adopt a zero-trust mindset even towards familiar platforms like GitHub. By staying vigilant and implementing robust verification and monitoring practices, organizations can mitigate the risk of such advanced supply chain attacks.