GITHUB COMMENTS ABUSED TO PUSH MALWARE VIA MICROSOFT REPO URLS

Summary from the TLDR InfoSec newsletter

Threat actors are exploiting a GitHub flaw to distribute malware through URLs linked to a Microsoft repository, tricking users into thinking the files are safe. This is accomplished by leaving a comment with an uploaded file in a Microsoft repository in GitHub, which uploads the file to GitHub CDN associated with Microsoft's repository, allowing the attacker to make the URLs look more trustworthy. GitHub and Microsoft have been contacted regarding this issue, but the distribution of malware continues through Microsoft's GitHub repository.