Fake GitHub Security Tools Deliver Backdoors and Infostealers

Cybersecurity professionals are being targeted by malicious GitHub repositories disguised as tools for security work, according to researchers at Dr. Web. The campaign began about two years ago, first targeting crypto wallet users before shifting to projects for automated scanning, security testing and log analysis.

Dr. Web says more than 2,000 Windows systems have been compromised. One repository posed as a lightweight script for parsing, cleaning and formatting output from the Fscan network scanner. Researchers found malicious code hidden in Visual Studio project files, Python scripts and Go source files. Some Visual Studio projects used a pre-build routine to run the code before compilation.

The infection chain uses PowerShell to retrieve an encrypted download link for a modular Electron-based loader named “Microsoft.exe.” The loader establishes persistence, elevates privileges, disables Windows security and recovery features, then injects malware into legitimate processes. Dr. Web describes six evasion techniques in the loader’s default Mode3. If that mode fails, Mode2 adds Microsoft Defender exclusions and uses PowerShell to decrypt and inject payloads into “RegAsm.exe.”

The delivered malware includes the AsyncRAT backdoor, a clipper that replaces crypto wallet addresses in the clipboard, and an information stealer. The stealer collects browser data, VPN settings, FTP client configuration files, gaming account data and Discord tokens, then sends the information through a Telegram bot. Dr. Web also says the malware attempts to remove ESET, McAfee and Malwarebytes, interfere with their update connections and disrupt Windows backups.

Researchers found an apparently unfinished component that could help keep the loader running and download it again if removed. They say this suggests the threat actor is working to add features. Dr. Web shared indicators of compromise from the campaign.