GitHub abused to distribute payloads on behalf of malware-as-a-service