Threat actors leveraged "technical assessment" projects, using consistent naming schemes to seamlessly integrate malicious cloning and build processes. They further concealed their operations by fetching loader scripts from external servers…