Cybersecurity professionals are being targeted with malicious security projects hosted on GitHub that deliver a backdoor and an information stealer. The campaign began roughly two years ago with lures aimed at cryptocurrency wallet users, but the threat actor has recently changed focus to repositories that claim to automate scans, security testing, and log analysis. Researchers at Dr. Web report that more than 2,000 Windows systems have been compromised so far.

One example identified by the researchers is a fake script advertised as a lightweight way to parse, clean, and format output from the Fscan network scanner. Earlier lures included blockchain games, bots, and cheat tools aimed at blockchain and gaming enthusiasts.

How the infection works

Dr. Web found malicious code concealed in Visual Studio project files, Python scripts, and Go source files. The code was hidden behind long stretches of whitespace, a simple technique that remains effective. In some Visual Studio projects, a pre-build event runs the code before compilation. PowerShell then retrieves an encrypted download link that fetches a modular Electron-based loader named Microsoft.exe.

The loader establishes persistence, elevates its privileges, disables Windows security and recovery features, and injects the next-stage payload into legitimate processes. Its default mode, Mode3, uses several evasion techniques, including:

  • Making explorer.exe appear as the parent process of the malware
  • Changing a registry value to disable Smart App Control
  • Restoring ntdll.dll from disk to remove hooks placed by security software
  • Making direct system calls to avoid interception by security tools
  • Patching EtwEventWrite in memory to suppress event tracing
  • Patching AmsiScanBuffer in memory to interfere with script scanning

If Mode3 fails, the loader falls back to Mode2, which adds Microsoft Defender exclusions and injects payloads into RegAsm.exe.

Final payloads

The delivered payloads include the AsyncRAT backdoor, clipper malware that swaps cryptocurrency wallet addresses in the clipboard, and an information stealer. The stealer collects browser data, VPN settings, FTP client configuration files, gaming account data, and Discord tokens, then exfiltrates them through a Telegram bot. According to Dr. Web, the malware also tries to remove ESET, McAfee, and Malwarebytes from the infected system, attempts to cut them off from their update servers, and interferes with Windows backups.

Researchers also found an apparently unfinished component designed to keep the loader running and re-download it if it is removed from disk, suggesting the operators are still developing the malware.

Defensive considerations

Security teams should treat unvetted GitHub repositories, particularly Visual Studio solutions and build scripts, as potentially hostile, and review pre-build events before compiling third-party code. Dr. Web has published a full list of indicators of compromise for this campaign.