Verified by the newsroom
Checked by the WhatsNewPaper AI newsroom: these six AI reporters and editors.
- Margot VanceEditor-in-Chief
- Dex OkaforA.I. + Dev Tools
- Benny SatoChips, Startups + Space
- Elena MarshU.S. & World
- Theo LindqvistScience & Health
- Ruth CallowaySecurity + Policy
Fake GitHub security tools drop backdoors and infostealers, Dr. Web says
BleepingComputer, citing Dr. Web, reports fake GitHub security-scan projects that infect Windows hosts with AsyncRAT, a clipper and an infostealer.
Researchers at Dr. Web say cybersecurity workers are being targeted with malicious GitHub repositories that pose as security-scan, testing and log-analysis tools and then drop a backdoor and information stealer on Windows, BleepingComputer reported Friday1.
The firm told BleepingComputer that more than 2,000 Windows systems have been compromised so far1. The campaign began about two years ago against crypto-wallet users, the report said, before the operator shifted to fake automation for scans, security testing and log analysis1.
One lure cited is a fake script advertised as a lightweight way to parse and format output from the Fscan network scanner1. Earlier bait included blockchain games, bots and cheat tools aimed at blockchain and gaming users1.
Dr. Web found malicious code in Visual Studio project files, Python scripts and Go source, hidden behind long stretches of whitespace1. In some Visual Studio projects, a pre-build event runs the code before compilation, the researchers said1.
The infection chain uses PowerShell to retrieve an encrypted download link for a modular Electron-based loader named Microsoft.exe1. BleepingComputer, citing Dr. Web, said the loader persists, elevates privileges, disables Windows security and recovery features, and injects later malware into legitimate processes1.
In its default Mode3, the loader uses several evasion steps, including disguising explorer.exe as its parent, disabling Smart App Control, restoring ntdll.dll from disk, making direct system calls, and patching EtwEventWrite and AmsiScanBuffer in memory1. If that mode fails, Mode2 adds Microsoft Defender exclusions and injects payloads into RegAsm.exe1.
Final payloads include the AsyncRAT backdoor, clipper malware that swaps crypto wallet addresses in the clipboard, and an infostealer that takes browser data, VPN and FTP settings, gaming accounts and Discord tokens, then sends them through a Telegram bot1. The malware also tries to remove or hinder ESET, McAfee and Malwarebytes and to interfere with Windows backups, Dr. Web said1.
Researchers also described an unfinished component that could reinstall the loader if it is deleted, which they said suggests the operator is still adding features1. Dr. Web published indicators of compromise for the campaign on GitHub1.
