A long-running campaign targeting cybersecurity professionals and developers has been identified, involving the distribution of malicious repositories on GitHub that deploy backdoors and information-stealing malware. While the threat actor behind this operation initially focused on luring cryptocurrency enthusiasts with fake blockchain games and cheat tools over the past two years, they have recently pivoted to masquerading as creators of legitimate security utilities. These deceptive projects often claim to provide tools for network scanning, log analysis, and security testing, such as a fake script purportedly designed to parse and format output from the Fscan network scanner.
Researchers at Dr. Web have confirmed that this campaign has successfully compromised more than 2,000 Windows systems. The malicious code is frequently embedded within Python scripts, Go source files, and Visual Studio project files. To evade detection, the attackers utilize a classic technique of hiding malicious instructions behind extensive blocks of whitespace within the code. In instances involving Visual Studio projects, the attackers leverage pre-build event routines to ensure the malicious code executes automatically before the compilation process even begins.
The infection process typically initiates via a PowerShell script that retrieves an encrypted download link, which in turn fetches a modular, Electron-based loader masquerading as a file named Microsoft.exe. Once executed, this loader establishes persistence on the host machine, escalates privileges, and systematically disables Windows security features and recovery options. The loader is designed to inject subsequent malicious payloads directly into legitimate system processes to avoid triggering alerts.
The loader operates primarily in a default state known as Mode3, which employs six distinct evasion techniques. These include spoofing the parent process of the malware to appear as explorer.exe, modifying registry keys to disable Smart App Control, and restoring the original ntdll.dll from disk to bypass hooks placed by security software. Furthermore, the loader performs direct Windows system calls to evade interception, patches EtwEventWrite to suppress event tracing, and patches AmsiScanBuffer to neutralize antivirus script scanning. If these methods fail, the loader falls back to Mode2, which adds exclusions to Microsoft Defender and uses PowerShell to inject payloads into RegAsm.exe.
Once the loader has successfully compromised the system, it delivers a suite of malicious payloads, including the AsyncRAT backdoor, a clipper designed to swap cryptocurrency wallet addresses in the system clipboard, and a comprehensive information stealer. The infostealer is capable of harvesting a wide array of sensitive data, including browser history, VPN configurations, FTP client settings, gaming account credentials, and Discord tokens. This stolen information is then exfiltrated to the attackers via a Telegram bot.
The malware also exhibits aggressive behavior toward existing security infrastructure. It actively attempts to uninstall or disable antivirus products from vendors such as ESET, McAfee, and Malwarebytes. Additionally, it seeks to sever the connection between these security tools and their update servers, while simultaneously interfering with the Windows backup process to prevent system restoration.
Evidence gathered during the investigation suggests that the threat actor is continuing to refine their toolkit. Researchers identified an unfinished component within the malware designed to maintain the loader’s presence and facilitate re-infection if the primary files are removed from the disk. This indicates that the campaign is active and that the developers behind it are actively iterating on their malicious infrastructure.
While the researchers have provided a detailed list of indicators of compromise to assist in detection and remediation, the campaign remains a significant threat due to its ability to mimic legitimate developer workflows. Users are advised to exercise caution when downloading and executing security scripts or project files from public repositories, particularly those that appear to be lightweight utilities or automation tools.
