ZIP Download Referred by GitHub Pages Multi-Hop Redirect Chain

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•6

Detects HTTP proxy requests for ZIP archives where the Referer header indicates a navigation originated from a GitHub Pages (github.io) site, but the destination is not a GitHub domain. This behavior is indicative of a multi-hop redirect chain used in campaigns to deliver malicious payloads, such as infostealers, by abusing GitHub Pages to redirect users to external hosting for ZIP archive downloads.