Fake GitHub Security Tools Compromise 2,000 Windows Systems

Dr. Web reports that malicious GitHub projects have compromised more than 2,000 Windows systems during a campaign running for roughly 24 months.

The actor initially targeted crypto-wallet users, according to the investigation. It recently shifted toward security professionals through repositories for automated scanning, security testing and log analysis.

Earlier lures included blockchain games, bots and cheat tools. Dr. Web says those lures typically targeted blockchain and game enthusiasts.

How does a fake security project reach a victim?

Dr. Web found a fake script in one malicious repository, advertised as a “lightweight solution” to parse, clean and format Fscan network-scanner output. Malicious code appeared in Visual Studio project files, Python scripts and Go source files. The code sat behind long stretches of whitespace, reviving an old concealment technique that researchers say remains effective.

In some Visual Studio projects, a pre-build event routine executes the code before compilation, Dr. Web said. The report does not state how many repositories carried the payload, how many downloads occurred, or how many installations produced an infection.

What does the Windows loader change?

The infection chain uses PowerShell to retrieve an encrypted download link, according to Dr. Web. That link fetches a modular Electron-based loader named Microsoft.exe.

Microsoft.exe establishes persistence, elevates privileges, disables Windows security and recovery features, and injects the next-stage malware into legitimate processes. Across the reported 2,000 compromised systems, Dr. Web provides no resistance rates, persistence-success figures, median infection time or evidence that every loader remained active.

How does Microsoft.exe evade security tools?

Dr. Web describes six evasion techniques in Mode3, the loader’s default operational mode:

• Makes explorer.exe appear to be the malware’s parent process.
• Changes a Windows registry value to disable Smart App Control.
• Restores original ntdll.dll code from disk to remove security-software hooks.
• Makes direct Windows system calls that security tools have difficulty intercepting.
• Patches EtwEventWrite in memory to suppress event tracing in the affected process.
• Patches AmsiScanBuffer in memory to interfere with antivirus scanning of scripts.

If Mode3 fails to launch, the loader switches to Mode2. Mode2 adds Microsoft Defender exclusions and uses PowerShell to decrypt and inject payloads into RegAsm.exe.

Dr. Web does not claim either mode always succeeds, and it reports no benchmark, detection rate or false-positive figure for either operational path in the investigation.

What can the final payloads steal or alter?

Dr. Web identifies three final payload classes delivered to compromised hosts:

• AsyncRAT, the campaign’s backdoor component.
• Clipper malware, which replaces crypto-wallet addresses in the clipboard.
• An information stealer for browser, VPN, FTP, gaming and Discord data.

The stealer collects browser data, VPN settings, FTP client configuration files, gaming-account data and Discord tokens, according to Dr. Web. It exfiltrates those details through a Telegram bot.

Dr. Web also found attempts to remove ESET, McAfee and Malwarebytes antivirus tools from infected computers. The malware tries to disconnect those three products from their update servers and interferes with Windows backups.

The investigation documents the malware’s capability set, but it does not say that every compromised host suffered full antivirus removal, successful clipboard substitution or confirmed data exfiltration.

What does the separate email-security offer claim?

The report also carries a separate Adaptive Security promotion: “Uncover email threats your existing defenses may miss.” The company says its AI agents analyze email intent, context and behavior to identify phishing, business email compromise and invoice fraud. It offers a free 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.

That offer remains separate from Dr. Web’s malware findings, and the promotion gives no customer count, measured detection improvement, regional availability or pricing for the scan.

What remains unproven?

Dr. Web researchers found a seemingly unfinished component that could keep the loader running. It could also download the loader again after removal from the host’s disk.

The researchers said the finding suggests the threat actor is working to improve the malware with new features. That conclusion remains an inference from unfinished code, not proof of broader deployment.

Dr. Web shared a complete list of indicators of compromise for the campaign, which gives defenders concrete artifacts but no affected-organization list or clean-up guidance. The report gives no repository count, geographic split, enterprise-to-home ratio, ransom figure, financial loss, remediation cost or incident-response cost for the 2,000 compromised systems. It also does not separate those systems from confirmed data-theft cases.