A malware campaign using fake GitHub projects posing as security tools has infected more than 2,000 PCs, according to Dr.Web’s November 5 analysis.
The researchers say the threat actor, which previously lured cryptocurrency and gaming users, has shifted toward repositories aimed at cybersecurity professionals, including tools for scan automation, security testing and log analysis.
One example is a fake utility advertised as a way to parse, clean and format output from the Fscan network scanner. Dr.Web found malicious code in Visual Studio project files, Python scripts and Go source files. Some Visual Studio projects use a pre-build event to run the code before compilation, while other payloads are hidden behind long stretches of whitespace.
The infection chain uses PowerShell to retrieve an encrypted download link for an Electron-based loader named Microsoft.exe. Dr.Web says the loader establishes persistence, elevates privileges, disables Windows security and recovery features, and injects malware into legitimate processes. Its default mode uses process-parent spoofing, disables Smart App Control, patches Event Tracing for Windows and the Antimalware Scan Interface, and restores original ntdll.dll code to remove hooks added by security software.
The payloads include the AsyncRAT backdoor, a clipper that replaces cryptocurrency wallet addresses copied to the clipboard, and JS.Stealer.191, which collects browser data, VPN settings, FTP client configuration files, gaming account information and Discord tokens. Dr.Web says the stolen data is sent through a Telegram bot and that the malware attempts to remove ESET, McAfee and Malwarebytes security products. The company has published a list of indicators of compromise for the campaign.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
