Research has unveiled a tool responsible for many recent GitHub phishing attacks.