Fake GitHub Security Tools Spread AsyncRAT: 2,000+ Computers Reported Infected, the Repositories Named and What to Check

Attackers have been posting fake security tools and crypto game bots on GitHub that infect the Windows computer of anyone who builds or runs them. Cyber Press reports Doctor Web's count as more than 2,000 infected computers, and it matters to businesses because a developer's or IT admin's machine often holds the logins to company websites, servers and code.

This is not a software flaw you can patch. Neither source we opened lists a CVE. The attack works because someone trusts a project and runs it, so the job this week is finding out what your people downloaded.

What happened with the fake GitHub security tools

Cyber Press reports that Doctor Web disclosed the campaign on November 5, 2026. According to that report, it first went after blockchain gaming fans, then widened to projects advertising scanning automation, security testing and log analysis. Each project's instructions talk the victim into installing Visual Studio and cloning the code.

Doctor Web's own indicator file on GitHub is headed "A Trojan targeting cybersecurity professionals has been found on GitHub" and gives these as examples of infected repositories:

• Olivaire/sleep-duck-eye
• Trivexqbk/Frp-Quick-Configuration-Panel
• Trivexqbk/FscanOutput-Beautify
• Auraleaf/SharpUserIP-login-logs-controller
• Xandrua/Fyx-Cryptocurrency-Form-eCommerce-Crypto-Payment-Api-Blockchain-Network
• BioInnovate42/Hamster-Hack-Game-Bot-Auto-Farm-Clicker-Crypto-Telegram-Api-Cheat
• Luminovav/Common-Ground-World-Crypto-Bot-Crypto-Game-Auto-Farm-Clicker-Cheat-Api
• Glyxoran/Catizen-Mini-Crypto-Game-Token-Api
• Zantiqim/Seekers-of-Tokane-Crypto-Game-Token-Api

The same file lists staging files in tb78/BreakFree and tb78/expresso. Do not download any of these to look at them.

Is the fake GitHub tools report confirmed?

Confirmed in Doctor Web's indicator file: the repository names, file hashes, detection names such as BackDoor.AsyncRAT.115 and JS.Stealer.191, four domains and two IP addresses.

Claimed, and reported second hand: the figure of more than 2,000 infected computers, the disclosure date and most of the behavior described below come from Cyber Press's summary of Doctor Web's report. Doctor Web's news site would not load when we checked, and the indicator file gives no infection count, so we could not check that number against Doctor Web's own text.

Not known: who is behind this, how the 2,000 was counted, how many victims are security staff rather than gamers, and which companies or countries were hit. We also could not confirm whether the listed repositories are still online, because those pages timed out when we checked. Doctor Web calls its list examples, so do not treat it as complete.

How malicious GitHub repositories infect a computer

According to Cyber Press's account of Doctor Web's findings, the malicious code hides in three places:

• Visual Studio project files. Commands sit in the PreBuildEvent of a .csproj file. Microsoft's documentation says build events run before the build starts and can include any command valid at a command prompt, so pressing Build is enough.
• .suo files. Microsoft says a .suo file holds per-user options and "should not be checked in to source code control," so one arriving inside a downloaded project is a warning sign.
• Python and Go files. The bad code is pushed out of view behind long runs of blank space. Doctor Web's file names FscanOutput_v2.2.py and resource.go.

From there, a PowerShell downloader fetches its next instructions from pages on YouTube, Telegram, Google Docs, GitCode and Pastebin. An Electron app installs to C:\ProgramData\Windows.Microsoft.Photos, runs as Microsoft.exe and survives restarts through scheduled tasks and registry Run entries.

What the AsyncRAT malware and stealer do

• Remote control. BackDoor.AsyncRAT.115 arrives as two payloads on different network ports, which Cyber Press says could let separate operators control one machine.
• Password and session theft. JS.Stealer.191 targets browser passwords, cookies, autofill data, Discord tokens, VPN configurations, messaging app files and saved connection files from FileZilla, MobaXterm and Total Commander.
• Crypto theft. Trojan.Clipper.688 swaps cryptocurrency wallet addresses on the clipboard and sends screenshots to a Telegram bot.
• Defenses switched off. The loader attempts to remove antivirus software, blocks security vendor domains through the hosts file, and disables Windows Defender, User Account Control, System Restore and Volume Shadow Copy.

Why this matters for a company network or website

The people being targeted are the ones holding the keys. FileZilla and MobaXterm files point straight at web servers, and a VPN configuration points at the internal network. One admin trying out a free log analysis tool can hand over more access than a phished sales account would.

Security tools also make good bait. They are software people already expect antivirus to complain about, which makes a warning easier to wave away. Contractors and outside developers carry the same risk with your credentials on their machines, so ask them the same questions.

Fake GitHub tools checklist for this week

1. Find the named repositories. Search developer PCs and your organization's GitHub forks for the names above. Ask staff whether they cloned scanners, log tools, FRP panels or crypto game bots from unfamiliar accounts.
2. Look for the install folder. Check Windows machines for C:\ProgramData\Windows.Microsoft.Photos containing Microsoft.exe, plus scheduled tasks and Run entries you cannot explain.
3. Hunt the hashes. Run the SHA-1 values from Doctor Web's file through your endpoint tools. Do not rely on file names, since resource.go is a generic name.
4. Search DNS and firewall logs. Look for muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com, muckdeveloper[.]com, 130[.]12.182[.]172 and 130[.]12.182[.]209.
5. Check the hosts file. Open C:\Windows\System32\drivers\etc\hosts and look for security vendor domains that should not be there.
6. Confirm Windows protection is on. Run Get-MpComputerStatus | Select-Object IsTamperProtected, RealTimeProtectionEnabled. Microsoft says True means enabled. To change it on one device, go to Windows Security, Virus & threat protection, Manage settings, then Tamper Protection.
7. Consider the obfuscated script rule. Microsoft's attack surface reduction rule "Block execution of potentially obfuscated scripts" supports PowerShell. Neither source says this or Tamper Protection stops this campaign. They raise the cost for attackers.
8. Set a rule for downloaded code. Read the .csproj for PreBuild and Exec lines before building, reject projects that ship a .suo file, and scroll sideways through scripts. Test on a machine with no company logins. The stealer reportedly checks for virtual machines and sandboxes first, so a clean run in one proves little.
9. If you get a hit, assume the machine is lost. Disconnect it and rebuild it, since System Restore and shadow copies may be gone. From a clean device, change saved passwords, sign out active sessions, and replace VPN and server credentials.
10. Report the project. On the repository's page, use Report repository in the About section.

Fake GitHub tools questions people are asking

Is GitHub itself hacked?

Nothing in the sources says so. Attackers created or used repositories on the platform and relied on people running the code.

How do I know if I ran a fake GitHub tool?

Check for the folder, hashes, domains and IP addresses in the checklist. A clean result lowers the risk but does not rule it out, because Doctor Web's repository list is only examples.

What is AsyncRAT?

It is remote access malware that lets an attacker control an infected Windows PC. Doctor Web detects the versions in this campaign as BackDoor.AsyncRAT.115.

Is there a patch for this GitHub malware?

No. No CVE or fixed version is listed, because the attack depends on someone building or running a malicious project.

Does it affect Mac or Linux?

The reported infection chain is Windows only, and neither source describes a Mac or Linux version.

Will antivirus catch it?

Do not count on it. The loader reportedly tries to remove antivirus software and turn off Windows Defender, so check independently.

The bigger lesson

A free tool from a stranger's GitHub account is still software installed with your employee's access. Stars and a tidy README do not tell you what runs when someone presses Build. Decide who may run outside code, where they may run it, and which logins that machine is allowed to hold.

Need developer machines and servers locked down? See security hardening or get a quote.

Get security alerts by email, with the free checklist.

Sources: Doctor Web indicators of compromise, Trojan.Loader.3261; Cyber Press summary of Doctor Web's report; Microsoft: Specify build events; Microsoft: Solution User Options file; Microsoft: Configure tamper protection; Microsoft: ASR rules reference; GitHub Docs: Reporting abuse or spam.