Operation STANDOFF: A Campaign Hiding C2 Behind GitHub Redirects

Reported 21 Jul 2026 by otx · Severity: medium

VMRay Labs uncovered a sophisticated Russian-speaking cybercriminal operation combining multiple attack vectors on shared infrastructure. The campaign distributes commodity stealers including Raccoon, RedLine, Amadey, SmokeLoader, Socelars, and Glupteba through a pay-per-install