Fake security tools on GitHub push backdoors and infostealers

A malware campaign has shifted from targeting cryptocurrency and gaming users to exploiting cybersecurity professionals through fake GitHub projects presented as tools for network scanning, security testing, and log analysis. Dr. Web researchers say the operation has been active for about two years and has compromised more than 2,000 Windows computers. Malicious code is concealed in Visual Studio project files, Python scripts, and Go source code, sometimes hidden among large blocks of whitespace. In Visual Studio projects, a pre-build command can run the code before a project is compiled.

The infection chain uses PowerShell to retrieve an encrypted download link and install an Electron-based loader called Microsoft.exe. The loader persists on the computer, seeks higher privileges, weakens Windows protections, and injects malware into legitimate processes. Its evasion tactics include disabling Smart App Control, tampering with security monitoring and antivirus scanning, and restoring system code altered by security tools; a fallback mode adds Microsoft Defender exclusions. The delivered malware includes the AsyncRAT backdoor, a clipboard tool that swaps cryptocurrency addresses, and an infostealer that collects browser, VPN, FTP, gaming, and Discord data, sending it through Telegram. The malware also attempts to remove several antivirus products and disrupt backups. Researchers found a possibly unfinished feature to reinstall the loader if deleted, suggesting the operation may still be evolving.