NightEagle GhostContainer - Disguised Tool Archive Download from GitHub

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•0

Detects HTTP downloads from GitHub involving specific repositories and archive naming patterns commonly associated with the 'NightEagle GhostContainer' threat activity. These patterns involve downloading ZIP files disguised as development or resource packages (e.g., 'mirror-js', 'browserthemes', 'resource-pack').