Kimsuky Operation GitPower Uses GitHub to Deliver Malware and Steal Data

Kimsuky is using GitHub and other trusted code platforms to deliver malware, run commands, and steal data from Ukrainian experts in diplomacy, security, and international policy. The North Korea-linked group’s Operation GitPower combines targeted emails, fake PDF files, and Windows scripts to turn routine work requests into possible entry points for cyber spying. The attacks use conference invitations and research requests to build trust before sending harmful files. Codeberg hosts malicious archives, GitLab supplies decoy documents and scripts, and GitHub supports payload delivery and data transfers. Most observed attempts against the Ukrainian targets were unsuccessful, an important limit on the campaign’s reported impact. Researchers from Genians identified the activity in an October 12, 2026 report, linking…