Secretive network exploits GitHub to spread malware and phishing links — nefarious actors attack from 3,000 shadow accounts