Fake GitHub Security Tools: Malware Hidden in Pentest and Log Analysis Projects Infected More Than 2,000 Windows PCs, What Is Confirmed and What to Check

Attackers have been planting malware in GitHub projects made to look like security tools: the scanners, log parsers and setup helpers that IT staff and penetration testers download every week. Antivirus company Doctor Web says the campaign has infected more than 2,000 Windows computers. The stolen data includes VPN settings, FTP logins and browser data, which is exactly what someone needs to get into a company network or website.

What happened with the fake GitHub security tools

On November 6, 2026, BleepingComputer reported on new research from Doctor Web (Dr.Web) into a long-running GitHub malware campaign. According to that report, the operation began about two years ago with fake crypto wallet tools, blockchain games, bots and game cheats. It then moved on to repositories offering scan automation, security testing and log analysis, the kind of thing a security professional would download without thinking twice.

One example is a project described as a lightweight script to parse, clean and format results from Fscan, a network scanner used in penetration tests. Doctor Web lists that repository, Trivexqbk/FscanOutput-Beautify, in its published indicators of compromise. When we checked on November 6, 2026, it was still public on GitHub, with a normal-looking README and more than 200 commits.

What is confirmed and what is only reported

Confirmed by Doctor Web's own indicators of compromise, which it published in its malware-iocs repository on GitHub under the title "A Trojan targeting cybersecurity professionals has been found on GitHub":

• Nine example infected repositories. They are a mix of crypto game bots and tool projects, including an FRP configuration panel, a login log controller and the Fscan output formatter.
• The infected file types: Visual Studio project files (.csproj), a Visual Studio solution settings file (.suo), a Go source file, a Python script and PowerShell scripts.
• The main loader, which Doctor Web detects as Trojan.Loader.3261, delivered as a file named Microsoft.exe. Later stages include BackDoor.AsyncRAT.115, Trojan.InjectNET.14 and a stealer, JS.Stealer.191, which runs as SearchFilterHost.exe.
• Four domains and two IP addresses used by the attackers (listed in the checklist below).

Reported by BleepingComputer from Doctor Web's write-up. Doctor Web's news site did not load when we tried to open the full report, so these details come from BleepingComputer's account of it:

• More than 2,000 compromised Windows systems so far.
• The loader sets itself up to survive restarts, raises its privileges, switches off Windows security and recovery features, turns off Smart App Control, blinds script scanning and event logging, and adds Microsoft Defender exclusions when its first method fails.
• It tries to remove ESET, McAfee and Malwarebytes, cuts them off from their update servers, and interferes with Windows backups.
• The final payloads are the AsyncRAT backdoor, a clipper that swaps crypto wallet addresses copied to the clipboard, and an infostealer. The stealer takes browser data, VPN settings, FTP client configuration files, gaming accounts and Discord tokens, and sends them out through a Telegram bot.

Not known: the total number of malicious repositories, who is behind the campaign, which countries or industries the victims are in, and whether GitHub has removed the accounts.

How the malware hides in GitHub code

Two tricks stand out, both reported from the Doctor Web research.

First, the malicious code sits after a long run of blank spaces. On GitHub's web view and in most editors, a line that looks empty can push the real code far off the right edge of the screen. A quick scroll through the file shows nothing unusual.

Second, some Visual Studio projects use a pre-build event. That is a command Visual Studio runs automatically before it compiles anything. So the malware runs the moment someone presses Build, before they have run the tool even once. A PowerShell command then fetches an encrypted download link and pulls down the Microsoft.exe loader.

The Python and Go files in the list work the same way: the code you can see does what the README promises, and the hidden part downloads the malware.

Why this matters for a company network or website

The people this campaign targets are the people with the keys. An IT administrator, outside contractor or penetration tester usually has VPN access, saved admin passwords in the browser, and FTP or SFTP settings for the company website on the same laptop where they try out new tools.

The stealer goes after exactly those things. A VPN profile and a saved browser session can get an attacker into your network without setting off a password reset. An FTP client configuration can give them write access to your website files. AsyncRAT gives them remote control of the machine itself. And because the loader switches off antivirus and backups, the infection can sit there unnoticed.

So a free tool that one staff member downloaded can turn into an incident for the whole company, even though nothing on your own servers was attacked directly.

What to do this week

Fake GitHub security tools questions people are asking

Is it safe to download tools from GitHub?

GitHub hosts the code. It does not vouch for it. Anyone can publish a repository, and this campaign shows a project can look active and well written while carrying malware. Treat a GitHub tool like any other download from a stranger.

How do I tell if a GitHub repository is malicious?

There is no single sign. Be wary of new accounts, commit histories that look padded, build steps that download things, and very long lines or large stretches of blank space. Check the build files, not just the README.

What is AsyncRAT?

AsyncRAT is a remote access trojan. Once it is installed, the attacker can control the computer remotely, run commands and pull files. In this campaign it is one of the final payloads.

Has GitHub taken the repositories down?

Not all of them. The Fscan repository Doctor Web names was still public when we checked on November 6, 2026. We have not seen a statement from GitHub.

Are Mac and Linux users affected?

The infections Doctor Web counted were on Windows, and the payloads it lists are Windows programs. The research as reported does not describe Mac or Linux payloads.

What should I do if I already ran one of these tools?

Take the machine offline, rebuild it, and change every credential stored on it from a different, clean device. Start with VPN, website hosting and email admin accounts.

The bigger lesson

Your company's security also depends on what the people with admin access download. A clear rule about where tools get tested, plus a separate machine for trying out unknown code, closes off a whole category of attack that patching alone never touches.

If you want help locking down admin workstations and credentials, see our security hardening service or request a quote.

Get security alerts like this one by email, along with our free checklist, at /security-alerts.

Sources: Doctor Web indicators of compromise for Trojan.Loader.3261; BleepingComputer.