Netskope Details TroyDen’s LuaJIT Lure Factory Across 300+ GitHub Packages
Summary
Netskope traces TroyDen’s Lure Factory to 300+ trojanized GitHub packages using paired LuaJIT components, sandbox-evasion delays and screenshot exfiltration. Analysis links three lure campaigns; credential theft is suspected, not confirmed.
Key points
- Netskope identified more than 300 delivery packages across GitHub repositories masquerading as tools for developers, gamers and other users.
- The packages pair a renamed LuaJIT runtime with an encrypted, obfuscated Lua script; the malicious behavior emerges when both components execute together.
- The payload checks for analysis environments and then uses an extreme sleep delay to evade timed sandboxes.
- After researchers patched the delay for analysis, the payload disabled WinINet proxy auto-detection, queried ip-api[.]com for geolocation, and captured and uploaded a full-desktop screenshot to Frankfurt-hosted C2 infrastructure.
- Netskope found identical payloads and shared infrastructure across three confirmed lure campaigns, including fake OpenClaw deployment, phone-tracker and Fishing Planet tools.
- DPAPI use and related LuaJIT loader research are consistent with credential harvesting, but the specific credentials targeted and TroyDen’s final-stage payload remain unconfirmed.
- Netskope says its Advanced Threat Protection detected the activity through behavioral heuristics and reported the repositories to GitHub.
Article Details
- Attack Vectors
- Trojanized GitHub repositories impersonated legitimate projects and used download links to deliver malicious ZIP packages.
- A batch file launched a renamed LuaJIT runtime together with an encrypted, obfuscated Lua payload; the components appeared benign when analyzed separately.
- The payload checked for debugger presence, low RAM, short system uptime, SeDebugPrivilege, and the computer name, then invoked a sleep lasting roughly 29,000 years to evade timed sandbox analysis.
- After analysis checks, the payload changed WinINet registry settings to bypass proxy auto-detection, queried ip-api.com for victim geolocation, captured a full-desktop BMP, and uploaded it over HTTP to C2 infrastructure.
- The C2 returned encrypted task and loader blobs. DPAPI loading and cryptographic API calls were observed; browser credential harvesting was described as consistent with the behavior, but the specific credentials targeted and final payload remain unconfirmed.
- Defensive Notes
- Analyze the renamed interpreter and opaque data file together, including their execution sequence, because individual-file analysis may not reveal the malicious behavior.
- The article reports detection by Netskope Advanced Threat Protection behavioral heuristics.
- The article says its published indicators are suitable for deployment in EDR and network-inspection tooling.
- Netskope reported the three identified malicious repositories to GitHub on 2026-03-20.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
coteynumer@gmail[.]com | Email retained in the commit history of the GitHub account linked by the article to the phone-tracker campaign. | |
| IPV4 | 213[.]176[.]73[.]130 | C2 address reported among Frankfurt infrastructure that returned the campaign's task and loader data. |
| IPV4 | 213[.]176[.]73[.]159 | Identified as a C2 server used by the campaign. |
| IPV4 | 217[.]119[.]129[.]118 | Identified as a campaign C2 server. |
| IPV4 | 217[.]119[.]129[.]121 | Identified as a campaign C2 server. |
| IPV4 | 217[.]119[.]129[.]122 | C2 server confirmed in an OpenClaw delivery package. |
| IPV4 | 217[.]119[.]129[.]76 | C2 server confirmed in an OpenClaw delivery package. |
| IPV4 | 89[.]169[.]12[.]241 | C2 server confirmed in an OpenClaw delivery package. |
| IPV4 | 94[.]156[.]154[.]6 | C2 server confirmed in an OpenClaw delivery package. |
| SHA256 | 11c06aab7aa3f1857cc9add05b392ba6bd62a7fd2d168e41d9ba5557a96c78f0 | SHA-256 hash of the malicious OpenClaw delivery ZIP docker-openclaw-v3.8.zip. |
| SHA256 | 28d09366dc7842fe42f44a27cb54c6e1ba6769f42a27b99f5d455efb1e6de454 | SHA-256 hash of the malicious Fishing Planet enhancement delivery ZIP. |
| SHA256 | 30694a0101abfeea642cb9de7fb7eb66789eea74d8d7257b39822d7dab59445d | SHA-256 hash of unc.exe, the renamed LuaJIT runtime distributed with the payload. |
| SHA256 | 357cd0a1601d24bbb7949637b352b0ace1f30f51f788a03cafa98316068938e0 | SHA-256 hash of the encrypted, obfuscated Lua payload license.txt. |
| SHA256 | 398ea394f9a4242ebe9fd67a5ca62445fc4a34b1731d4f99b8eea5e65a98ddcb | SHA-256 hash of the malicious phone-tracker delivery ZIP location_number_tracking_tool_phone_v2.5.zip. |
| SHA256 | 39d39e6726408e778c8ad3d85010e1db0a686ebec1f8807f96cf80be59dfdd59 | SHA-256 hash of Launcher.cmd, a malicious execution trigger in phone-tracker delivery packages. |
| SHA256 | 3fc5816afde3e58bf9fcaa1b3873f2d4bc8629ee7a8341a4a4979d2729cad5e6 | SHA-256 hash of the malicious phone-tracker delivery ZIP location-tracking-tool-phone-number-v3.3.zip. |
| SHA256 | 5343326fb0b4f79c32276f08ffcc36bd88cde23aa19962bd1e8d8b80f5d33953 | SHA-256 hash of luajit.exe distributed in malicious phone-tracker and game-cheat packages. |
| SHA256 | 593916916552ce87cd6fde7353875e023cd8a89f13d222fc636634a43ff65cdb | SHA-256 hash of clib.txt, a payload component in a Fishing Planet delivery package. |
| SHA256 | 66ee4143e50c42b26f1059a33860d49513194c6b049245c9a68a45dbefa40ec1 | SHA-256 hash of the malicious Fishing Planet delivery ZIP fishing_planet_enhanced_menu_3.9.zip. |
| SHA256 | 8e322af81744217427abef3cab949aee1de70f1506f40e4e2d672af9e1f6ef0b | SHA-256 hash of Application.bat, a malicious execution trigger in an OpenClaw delivery package. |
| SHA256 | 964dfb63ff140149ed8b310dba63fd8d82a82dc9979348e93b3dd7206fd71d13 | SHA-256 hash of Launcher.cmd, a malicious execution trigger in a Fishing Planet delivery package. |
| SHA256 | b1d3e7e81016561faddf7b0a6cb9a3bd0174064b3b309c6948f5f1e6688a1381 | SHA-256 hash of lua.exe, a LuaJIT runtime distributed in an OpenClaw delivery package. |
| SHA256 | b1f9c4d82eb5f73b9081c3d414b3c053c1550e46fa21d30079134be3c0040ddb | SHA-256 hash of the malicious OpenClaw delivery ZIP openclaw-docker-v1.6.zip. |
| SHA256 | b54ea465f77f1eb726d3244aa52d13c103ad9c4fc5a15061b7067347896b433c | SHA-256 hash of a malicious Launch.bat execution trigger distributed in campaign packages. |
| SHA256 | b5c571363632a6887c6e9471435ab0fdcbf16bae6dbdf28d0fc755a9d467e859 | SHA-256 hash of cdef.txt, a payload component in phone-tracker delivery packages. |
| SHA256 | b6e81d95c0c336e8b8bde3889f4df4ee17639f6ff055c631de19cab3c7efb63b | SHA-256 hash of the malicious phone-tracker delivery ZIP tracking-tool-location-number-phone-3.2.zip. |
| SHA256 | c58720dcb30e5c887ff5bfd41bb46a611f2655128f1ef1a771e1745f24349dfe | SHA-256 hash of base.txt, a payload component in OpenClaw delivery packages. |
| SHA256 | c655c2d410e6b36d9ef1359aef67183bf76c193c609697492e41d30622f7ebd4 | SHA-256 hash of the malicious OpenClaw delivery ZIP docker-openclaw-v1.8.zip. |
| SHA256 | c7a657af5455812fb215a8888b7e3fd8fa1ba27672a3ed9021eb6004eff271ac | SHA-256 hash of lua51.dll distributed as part of malicious phone-tracker and game-cheat packages. |
| URL | hxxps[:]//t[.]me/NumberLocationTrack | Telegram channel used to advertise the phone-location service under the TroyDen operator name. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe Lua payload is encrypted and obfuscated, including with Prometheus Obfuscator.T1041 · Exfiltration Over C2 ChannelThe payload uploads the victim's screenshot to C2 over the same HTTP channel used for task and loader exchanges.T1059.003 · Windows Command ShellLaunch.bat or a similar batch trigger runs a command that launches the renamed LuaJIT runtime with the payload.T1059.011 · LuaThe LuaJIT runtime executes the encrypted and obfuscated Lua payload.T1071.001 · Web ProtocolsThe malware communicates with its C2 over HTTP using POST and GET endpoints.T1082 · System Information DiscoveryThe payload queries system characteristics including RAM, uptime, and computer name.T1105 · Ingress Tool TransferThe C2 responds with encrypted task and loader blobs that the payload saves to the victim's Documents directory.T1112 · Modify RegistryThe payload writes registry settings that disable WinINet proxy auto-detection and alter related proxy settings.T1113 · Screen CaptureThe payload captures a full-desktop BMP screenshot.T1204.002 · Malicious FileThe delivery relies on a user downloading and executing the malicious package and its batch trigger.T1497.001 · System ChecksThe payload checks RAM, system uptime, and other environment characteristics to identify analysis systems.T1497.003 · Time Based ChecksThe payload invokes a sleep of roughly 29,000 years to outlast timed sandbox analysis.T1622 · Debugger EvasionOne of the payload's anti-analysis checks queries for debugger presence.
Threat Actors
Vendors
GitHubThreat Labs discovered a coordinated malware campaign—tracked as TroyDen’s Lure Factory—using trojanized GitHub repositories (300+ delivery packages) that deliver a twoâcomponent LuaJIT loader and encrypted scriptNetskopeNetskope Threat Labs discovered a coordinated malware campaign—tracked as TroyDen’s Lure Factory—using trojanized GitHub repositories (300+ delivery packages) that deliver a twoâcomponent LuaJIT loader and encrypted
Products
LuaJITLure Factory—using trojanized GitHub repositories (300+ delivery packages) that deliver a twoâcomponent LuaJIT loader and encrypted script designed to evade automated analysis and exfiltrate full desktop screenshotsNetskope Advanced Threat ProtectionNetskope Advanced Threat Protection detected this threat through behavioral heuristics, stopping customers from ever being compromised, without prior knowledge of the threat.OpenClaw#TroyDen #OpenClaw