Armored Likho Abuses GitHub as Backup C2 Channel for Audio Surveillance Malware

Armored Likho, also known as Eagle Werewolf, has launched a new cyber-espionage campaign targeting individuals and organizations in Russia. The group used fake donation applications as bait, but its latest malware toolkit is the bigger concern. The attackers can steal Telegram session data, collect messages and media, and secretly record audio from infected Windows systems. The campaign, observed in May 2026, affected private users as well as organizations in the public…