Malware And CampaignsCampaign

REF1695 fake installer campaign uses GitHub to host payloads

April 3, 2026The Hacker News

The Hacker News describes REF1695 distributing RATs, crypto miners, and CNB Bot via fake installers and ISO files, including tactics to bypass Windows protections and using GitHub as hosting for payload delivery.

A cybercrime campaign since 2023 spreads malware via fake installers.
REF1695 delivers RATs, crypto miners, and CNB Bot via ISO files, tricks users to bypass Windows protections, and uses GitHub to host payloads.
The Hacker News
malwaregithubgithubmalware

See what experts are saying right now

This finding is one of many signals tracked across Cyber Security. The live feed updates every few hours with new expert voices, debates, and emerging ideas.

← Back to Cyber Security