DSLU investigated a multi-stage phishing campaign targeting Ukrainian civil society that combines reply-baiting, malicious LNK files, GitHub+GitLab abuse, and fileless execution. The attack starts with a harmless-looking collaboration email with no links or attachments. Only after the victim replies do the attackers send a link to an archive containing an LNK file disguised as a PDF. Once opened, it displays a decoy document while executing malicious code in the background. The attackers use GitHub to deliver additional code, establish persistence through a scheduled task, and collect and exfiltrate data from the compromised system. Full technical analysis and IOCs: dslua.org/publications/livin…