MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities

A sophisticated Malware-as-a-Service operation is leveraging Emmenhtal and Amadey loaders, fake GitHub accounts, and overlapping tactics with previous SmokeLoader campaigns to deliver a variety of malicious payloads—primarily targeting Ukrainian entities—while exploiting GitHub’s infrastructure to evade detection and streamline malware distribution.