Fake GitHub Security Tools Infect Over 2,000 PCs With Malware

The campaign began two years ago with Visual Studio projects related to blockchain games, game bots and cheats, aimed at people who used crypto wallets. According to Doctor Web, the attackers hid malicious code in project files and provided instructions for installing Visual Studio and downloading the projects from GitHub. The researchers have now found fake GitHub projects offering tools for automated scanning, security testing and log analysis, including one that claims to analyze and clean results from the Fscan security scanner.

Doctor Web reports that the malware, once opened, runs a PowerShell script that contacts attacker servers and legitimate platforms including YouTube, Telegram, Google Docs, GitCode and Pastebin. The main program, Microsoft.exe, disables Windows Defender, UAC, System Restore and shadow copies, removes McAfee, ESET and Malwarebytes, and deploys three payloads: AsyncRAT, a clipper that swaps crypto wallet addresses, and a stealer that takes browser data, VPN settings, messenger files and Discord tokens. Doctor Web also found an unfinished component that could install itself as a system service and install updates.

Doctor Web advises users to keep their antivirus software up to date and to scan every file they download. The researchers warn that the attackers are constantly updating the Trojans and adding new features.

למה זה חשוב For security teams, the shift from game-related lures to projects aimed at security practitioners means that scanning tools and security utilities downloaded from GitHub can no longer be treated as trusted by default. Investigators should check whether such projects were run on endpoints, look for the Defender, UAC and antivirus tampering described, and review crypto wallet and credential exposure. Because the attackers are still developing the malware, organizations should expect new features in later variants.