The campaign uses a Lua-written malware loader, which is distributed via malicious ZIP archives hosted on GitHub's platform.
