Fake security tools on GitHub distribute backdoors and info-stealers

Cybersecurity professionals are being targeted by a sophisticated malware campaign on GitHub involving malicious projects disguised as security and network scanning tools. Researchers at Dr. Web have identified over 2,000 compromised Windows systems associated with these repositories.

• Campaign has been active for two years, initially targeting crypto users
• Malicious code is embedded in Visual Studio, Python, and Go project files
• Uses PowerShell and modular Electron-based loaders for persistence
• Targets include browser data, VPN settings, and crypto wallets

Technical Analysis of the Campaign The threat actors use sophisticated evasion techniques, including hiding malicious code behind excessive whitespace and triggering it during Visual Studio pre-build events. Once executed, the modular loader, named ‘Microsoft.exe’, gains administrative privileges, disables Windows security features, and patches system calls to hide its activities from antivirus software.

The malware operates in multiple modes to ensure successful execution. It bypasses security by patching AmsiScanBuffer in memory to prevent script detection and suppresses event tracing. If necessary, it adds exclusions to Microsoft Defender to maintain persistent access to the host machine.

Payload and Data Exfiltration Once established, the malware deploys the AsyncRAT backdoor, a cryptocurrency clipper that hijacks clipboard data, and a robust information stealer. The stealer harvests credentials from browsers, FTP clients, gaming platforms, and Discord, exfiltrating the data to the attackers via Telegram bots. The malware also attempts to sabotage security suites like ESET and Malwarebytes.

Implications for the Tech Industry This campaign highlights the vulnerability of the supply chain in open-source platforms. For developers, the lesson is clear: do not trust automated scripts or security tools on GitHub without rigorous code auditing. Security teams should implement strict policies for running pre-compiled binaries or complex project files, as the use of legitimate platforms for malware distribution remains a growing threat.