Threat watch / Campaign
Fake security tools on GitHub infect more than 2,000 PCs of the people building them
Dr.Web describes GitHub repositories posing as scanning, security-testing and log-analysis tools. Hidden code runs when the project is built or opened, then installs a backdoor, a clipboard hijacker for crypto addresses and an infostealer. Dr.Web counts more than 2,000 infected PCs; the first such repositories appeared about two years ago.
- Sector
- Tech & SaaS
- Way in
- Supplier
- Product or vendor
- GitHub
- How it happened
- Dr.Web says the code hides in the project files: a pre-build event in Visual Studio .csproj files runs it before compilation, .suo files carry a PowerShell command, and Python and Go files hide it behind long runs of whitespace. PowerShell then downloads an Electron loader named "Microsoft.exe", which fetches the rest. Early repositories posed as blockchain games, bots and cheats; newer ones pose as security tools, such as a parser for Fscan output.[1][2] Checked 8 Nov 2026
- What was stolen
- Dr.Web says an infostealer takes browser data, FileZilla, MobaXterm and Total Commander FTP settings, VPN settings, messenger files, game accounts and Discord tokens, sent out through a Telegram bot. A clipper swaps crypto wallet addresses in the clipboard, and two AsyncRAT backdoors give remote control. The malware disables Windows Defender and tries to remove ESET, McAfee and Malwarebytes.[1] Checked 8 Nov 2026
- Who was impacted
- People who downloaded and built these projects, now including security practitioners. Dr.Web says "more than 2,000 PCs were infected" at the time of its research. Countries and organizations are not named.[1][2] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- Dr.Web publishes its research: the first infected repositories appeared about two years ago, the campaign now targets security tool users, and more than 2,000 PCs are infected. It publishes indicators of compromise and names no group. [1]
- BleepingComputer reports the campaign. Neither source says whether GitHub has removed the repositories. [2]