Malicious GitHub Repos Target Security Pros

A GitHub repository offering a tidy little script to clean up Fscan output looks like the kind of shortcut a busy security analyst might bookmark. According to researchers at Dr. Web, some of those repositories are not shortcuts at all — they are the delivery vehicle for a backdoor, a clipboard-hijacking clipper, and an information stealer. The campaign behind them has been running for roughly two years, and the researchers say it has already compromised more than 2,000 Windows systems.

The targeting has shifted over that period. Dr. Web reports the operation began by going after cryptocurrency wallet users and has more recently been pointed at cybersecurity professionals, with malicious repositories dressed up as tools for automating scans, security testing, and log analysis.

A fake Fscan helper as bait

One repository the researchers examined advertises itself as a lightweight script for parsing, cleaning, and formatting the output of Fscan, a network scanner. The pitch is plausible enough for the audience it is aimed at: analysts who run scanners regularly and want the results in a more readable form.

That is the pattern across the campaign, according to Dr. Web. Earlier lures included blockchain games, bots, and cheat tools, aimed at blockchain and gaming enthusiasts. The pivot to security utilities keeps the same basic playbook — find a community that downloads useful-looking code from GitHub, then publish code that looks useful.

The researchers say the malicious code was embedded in Visual Studio project files, Python scripts, and Go source files. In the project files, the payload is tucked behind long runs of whitespace, an old concealment trick that the researchers note still works. In some Visual Studio projects, a pre-build event routine executes the code before compilation even begins, according to Dr. Web.

How the infection chain runs

Once the malicious code runs, the chain moves through PowerShell, which retrieves an encrypted download link. That link fetches a modular loader built on Electron and named Microsoft.exe — a filename chosen to blend in on a Windows host.

The loader then sets up persistence on the machine, elevates its privileges, disables Windows security and recovery features, and injects the next-stage malware into legitimate processes. Dr. Web's writeup describes the loader as modular, with different operational modes that the operators can fall back on if the primary path fails.

According to the researchers, the full list of indicators of compromise observed in the campaign has been shared as a complete list of indicators of compromise for defenders to check against.

Six ways the loader hides

Dr. Web details six evasion techniques built into the loader's Mode3, which the researchers describe as its default operational mode:

• It makes explorer.exe appear to be the malware's parent process.
• It changes a Windows registry value to disable Smart App Control.
• It restores original ntdll.dll code from disk to remove hooks added by security software.
• It makes direct Windows system calls that are harder for security tools to intercept.
• It patches EtwEventWrite in memory to suppress event tracing in the affected process.
• It patches AmsiScanBuffer in memory to interfere with antivirus scanning of scripts.

If Mode3 fails to launch, the loader switches to Mode2, which adds Microsoft Defender exclusions and uses a PowerShell script to decrypt and inject the payloads into RegAsm.exe.

Taken together, the techniques are aimed at the telemetry and scanning layers that endpoint tools rely on — parent-process checks, event tracing, script scanning, and user-mode hooks. The loader is not exploiting a single unpatched flaw; it is trying to make the activity look ordinary to the tools watching it.

What lands on the host

The final payloads delivered to an infected machine are the AsyncRAT backdoor, clipper malware that replaces cryptocurrency wallet addresses in the clipboard, and an information stealer.

Dr. Web says the infostealer collects browser data, VPN settings, FTP client configuration files, gaming account data, and Discord tokens, then exfiltrates the details through a Telegram bot. The mix of data types points at a broad grab rather than a narrow focus on one platform — credentials and session material from several categories of software on the same machine.

The stealer also goes after the security software itself. According to the researchers, the malware attempts to remove ESET, McAfee, and Malwarebytes antivirus tools from the infected computer, tries to disconnect them from their update servers, and interferes with Windows backups.

Dr. Web's report describes the campaign's evolution and mechanics; the researchers say the malware pulls together a modular loader, a remote-access backdoor, clipboard manipulation, and data theft in one package.

"The loader establishes persistence on the infected host, elevates its privileges, disables Windows security and recovery features, and injects the next-stage (malware) into legitimate processes."

— Dr. Web researchers, in their analysis of the malicious GitHub campaign

An unfinished update mechanism

Dr. Web also found what it describes as a seemingly unfinished component that could help keep the loader running and download it again if it was removed from the host's disk. The researchers say the finding suggests the threat actor is working to improve the malware with new features.

An unfinished component is not the same as an active capability, but it is a marker of where the development effort is going. A loader that can reinstall itself after removal would change the cleanup calculus for anyone infected — removing the visible payload would no longer be enough on its own.

The numbers behind the campaign

The data points Dr. Web has published about the operation, as reported:

• About two years — the campaign's running time, per the researchers.
• More than 2,000 Windows systems compromised so far.
• Six evasion techniques described in the loader's Mode3 default mode.
• Payloads including AsyncRAT, a clipboard clipper, and an information stealer.
• Targeted antivirus removals: ESET, McAfee, and Malwarebytes.

Who is exposed, and how to check

The obvious exposure is to anyone who has downloaded and run a security utility from a GitHub repository without reading what it does first. The campaign's earlier phase tied it to crypto wallet users and gamers; the current phase ties it to people who automate security work — scan output parsing, testing, log analysis.

Dr. Web has published its indicator list for defenders. Checking a host against those indicators, reviewing PowerShell execution tied to downloaded projects, and auditing Visual Studio pre-build events in any project pulled from an untrusted repository are the concrete steps the research points toward.

There is also the question of how the repositories were found in the first place. A script advertised as a lightweight helper for a widely used scanner sits in a category of tooling that gets passed around by word of mouth. The researchers' account suggests the operators understood that distribution pattern and built lures for each community they targeted.

What this means for security teams

The uncomfortable part of this campaign is the audience. Security professionals are trained to treat downloaded code with suspicion, and the lures here were built for exactly that audience — tools for doing security work, published where security people look for tools.

That suggests a specific kind of risk for organizations: a compromised analyst workstation sits inside the perimeter, with access to internal systems, credentials, and the tooling used to defend them. An infostealer that lifts browsers, VPN configuration, FTP clients, and Discord tokens from that machine is not stealing from a random consumer — it is collecting the material that connects a security team to the rest of the business.

The antivirus-removal behavior compounds it. If the malware can strip ESET, McAfee, or Malwarebytes from the host and cut their update connections, the machine's defenses degrade at the same moment the intruder gains a foothold, which could make early detection harder for teams that rely on those tools reporting back.

What the campaign does not appear to involve is a software vulnerability in GitHub or in the targeted scanners. The repositories are the lure, not the exploit — the code executes because someone chose to run it. That puts the practical burden on review habits: reading pre-build events, treating long whitespace runs in source files as a reason to look closer, and being wary of a tool that does exactly what you need but comes from an unfamiliar account.

The unfinished reinstall component suggests the operators are still building. For defenders, that means the indicator list Dr. Web published is a snapshot, and the campaign's tooling may look different the next time it appears in a repository feed.