A campaign spreading fake security tools on GitHub has compromised more than 2,000 Windows systems by deploying backdoors and information-stealing malware, according to researchers at cybersecurity firm Dr. Web. The campaign, active for about two years, recently shifted from targeting crypto wallet users to cybersecurity professionals.
One malicious repository was a fake script advertised as a lightweight solution to parse, clean, and format output from the Fscan network scanner.
Dr. Web's investigation found malicious code embedded in Visual Studio project files, Python scripts, and Go source files, hidden behind long stretches of whitespace. In some Visual Studio projects, the researchers say, a pre-build event routine runs the code before compilation.
The infection chain uses PowerShell to retrieve an encrypted download link that fetches a modular Electron-based loader named 'Microsoft.exe'. The loader establishes persistence, elevates its privileges, disables Windows security and recovery features, and injects the next-stage malware into legitimate processes.
Dr. Web describes six evasion techniques in the loader's default Mode3 mode. These include making explorer.exe appear as the parent process, disabling Smart App Control, restoring original code to remove security software hooks, making direct system calls, and patching EtwEventWrite and AmsiScanBuffer. If Mode3 fails to launch, Mode2 adds Microsoft Defender exclusions and uses a PowerShell script to decrypt and inject payloads into 'RegAsm.exe'.
The final payloads delivered are the AsyncRAT backdoor, clipper malware that swaps cryptocurrency wallet addresses in the clipboard, and an information stealer. The infostealer collects browser data, VPN settings, FTP client configuration, gaming account data, and Discord tokens, exfiltrating the data through a Telegram bot.
According to Dr. Web, the malware attempts to remove ESET, McAfee, and Malwarebytes antivirus tools, tries to disconnect them from update servers, and interferes with Windows backups. Dr. Web researchers found a seemingly unfinished component that could help keep the loader running and re-download it if removed, suggesting the threat actor is working to improve the malware.
Analysis
Why This Matters
- Cybersecurity professionals are directly targeted, potentially providing attackers with a springboard into sensitive client networks.
- The use of GitHub to distribute weaponised tools undermines trust in shared security resources.
- The malware's sophisticated evasion, anti-AV, and resilience features indicate a well-resourced threat actor actively developing their capabilities.
Background
The campaign began roughly two years ago targeting blockchain and gaming enthusiasts with lures like fake games, bots, and cheat tools. The shift to posting malicious security repositories on GitHub represents a strategic escalation, aiming directly at the cybersecurity industry itself.
What to Watch
- Whether the threat actor expands the campaign to other developer platforms or deploys the unfinished resilience component observed by Dr. Web.
- Potential for additional victims beyond the 2,000 reported, given the campaign's duration and recent change in targeting.
- Platform and community responses to improve detection of malicious code in repositories.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedFake security projects on GitHub target cybersecurity professionals with backdoor and information-stealing malware.BleepingComputer: “Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware.”
- SupportedDr. Web researchers found that more than 2,000 Windows systems have been compromised.BleepingComputer: “Researchers at cybersecurity company Dr. Web found that more than 2,000 Windows systems have been compromised so far.”
- SupportedThe campaign began about two years ago, first targeting crypto wallet users, and recently shifted focus to cybersecurity professionals.BleepingComputer: “The campaign started about two years ago and initially targeted crypto wallet users, but recently the threat actor switched focus”
- SupportedOne malicious repository was a fake lightweight script for parsing, cleaning and formatting Fscan output.BleepingComputer: “One malicious repository they found is a fake script advertised as a lightweight solution to parse, clean, and format output from the Fscan network scanner.”
- SupportedMalicious code was embedded in Visual Studio project files, Python scripts and Go source files, hidden behind long stretches of whitespace; some Visual Studio projects ran it in a pre-build event.BleepingComputer: “Dr. Web's investigation found malicious code embedded in Visual Studio project files, Python scripts, and Go source files, hidden behind long stretches of whitespace”
- SupportedPowerShell retrieves an encrypted download link that fetches a modular Electron-based loader named Microsoft.exe.BleepingComputer: “The infection chain uses PowerShell to retrieve an encrypted download link that fetches a modular Electron-based loader named ‘Microsoft.exe.’”
- SupportedThe loader's default Mode3 has six evasion techniques.BleepingComputer: “Dr. Web describes six evasion techniques in the loader’s Mode3 mode, which is its default operational mode:”
- SupportedMode3 makes explorer.exe appear to be the malware's parent process.BleepingComputer: “Makes explorer.exe appear to be the malware’s parent process”
- SupportedIf Mode3 fails to launch, Mode2 adds Microsoft Defender exclusions and uses PowerShell to decrypt and inject payloads into RegAsm.exe.BleepingComputer: “If that mode fails to launch, the loader uses Mode2, which adds Microsoft Defender exclusions and uses a PowerShell script to decrypt and inject the payloads into ‘RegAsm.exe.’”
- SupportedThe final payloads are AsyncRAT, clipper malware and an information stealer.BleepingComputer: “The final payloads delivered to the host are the AsyncRAT backdoor, clipper malware that replaces crypto wallet addresses in the clipboard, and an information stealer.”
- SupportedThe infostealer collects browser data, VPN settings, FTP client configuration, gaming account data and Discord tokens, and exfiltrates them through a Telegram bot.BleepingComputer: “The infostealer collects browser data, VPN settings, FTP client configuration files, gaming account data, and Discord tokens, and exfiltrates the details through a Telegram bot.”
- SupportedDr. Web researchers found an unfinished component that could help keep the loader running and download it again if removed, suggesting the actor is working to improve the malware.BleepingComputer: “Dr. Web researchers also found a seemingly unfinished component that could help keep the loader running and download it again if it was removed from the host’s disk. This finding suggests that the threat actor is working to improve the malware with new features.”
