Fake GitHub Security Tools: Malware Hidden in Developer Projects Infected More Than 2,000 PCs, and What to Check This Week

Researchers at the antivirus company Doctor Web have found malware hidden inside GitHub projects that pose as security and developer tools. They report that more than 2,000 PCs were infected at the time of their research. If anyone at your company downloads code from GitHub to try it out, one booby-trapped project on a work laptop can give attackers remote control of that machine and copies of its saved passwords, VPN settings and server logins.

What happened with the fake GitHub security tools

Doctor Web says the campaign started about two years ago with Visual Studio projects about blockchain games, game bots and cheats. Those projects were aimed at people who hold crypto wallets, and they came with step-by-step install instructions for beginners.

The attackers then turned to a new audience: information security professionals. The newer fake repositories claim to automate scanning, test security systems or analyze logs. One example in Doctor Web's published indicator list is a repository called FscanOutput-Beautify. BleepingComputer describes it as a fake script advertised to parse, clean and format output from the Fscan network scanner.

Doctor Web's indicator list on GitHub names nine infected repositories as examples. They include that one and several crypto game "auto farm" and "cheat" projects.

What is confirmed and what is not known

Confirmed in Doctor Web's own published indicators of compromise:

• File names, SHA-1 hashes and Dr.Web detection names for each stage, from the poisoned project files to the final payloads.
• The repository names used as lures, plus the attacker domains and IP addresses.
• The final payloads include the AsyncRAT backdoor (detected as BackDoor.AsyncRAT.115) and a stealer packaged as SearchFilterHost.exe (detected as JS.Stealer.191).

Reported by Doctor Web and repeated by BleepingComputer and Security Affairs. We could not check these against the full report because Doctor Web's news site would not load when we wrote this:

• The figure of more than 2,000 infected PCs.
• The detailed behavior described below.

Not known from the sources:

• Whether GitHub has removed all the repositories. Neither news report says.
• Who is behind the campaign, or which countries the victims are in.
• How many of the infected PCs belong to businesses.

How the GitHub malware gets onto a PC

The malicious code sits inside files people rarely read. Doctor Web found it in Visual Studio solution and project files (.suo and .csproj), Python scripts and Go source files, pushed out of view behind long runs of blank space. If you glance at the file in a browser, nothing looks wrong.

BleepingComputer reports that in some Visual Studio projects, a pre-build event runs the hidden code before the project is even compiled. Building the tool is enough to set it off. You never have to run the finished program. Security Affairs' summary of the research says opening a project starts the infection.

Next, a PowerShell script fetches an encrypted link. According to Security Affairs, the script looks for it on attacker servers and on ordinary services: YouTube, Telegram, Google Docs, GitCode and Pastebin. Doctor Web's indicator list includes entries on all five. The link leads to an archive disguised as a Windows component, and that archive delivers the main program, named Microsoft.exe.

What the malware does on a Windows PC

Microsoft.exe is a modular loader built on Electron. The reports say it:

• Sends system information to a Telegram bot, sets itself to survive restarts and gives itself higher privileges.
• Disables Windows Defender, User Account Control, System Restore and shadow copies, and removes or tries to remove McAfee, ESET and Malwarebytes.
• Runs in a default mode called Mode3 that uses six evasion techniques. These include turning off Smart App Control and patching the Windows functions that security tools depend on (AMSI and ETW). If that fails, a fallback called Mode2 adds Microsoft Defender exclusions and injects payloads into RegAsm.exe, a legitimate Windows process.

It then delivers three payloads:

• AsyncRAT, a remote access trojan, running as two copies on different ports.
• A clipper that swaps any crypto wallet address copied to the clipboard for the attacker's own and takes screenshots.
• A stealer that takes browser data, FileZilla, MobaXterm and Total Commander settings, VPN settings, messenger files, game accounts and Discord tokens, then sends them out through Telegram.

The reports also say the malware edits the Windows hosts file so the computer can no longer reach antivirus vendors' websites. They do not make clear which component does this.

Doctor Web also found an unfinished component that could install itself as a system service and restore itself after removal. That suggests the attackers are still developing their tools.

Why this matters for a company network

FileZilla, MobaXterm and VPN settings are not personal files. They hold the saved logins to your web servers, hosting accounts and office network. If a developer or IT contractor tries one of these fake tools on a work laptop, an attacker could get the keys to every system that person looks after, plus a live backdoor inside your network.

The people being targeted have the most access: developers, system administrators and security testers. And because the malware switches off antivirus and recovery features, your usual safety net may not catch it.

What to do this week

Doctor Web's own advice is to keep antivirus software up to date and scan every downloaded file. This malware turns antivirus off once it runs, so the scan has to happen before anyone opens or builds the project.

Fake GitHub malware questions people are asking

Was GitHub itself hacked?

No. Nothing in the reports says GitHub was breached. The attackers set up their own accounts and uploaded fake projects, which anyone can do.

How many computers were infected?

Doctor Web reported more than 2,000 infected PCs at the time of its research. No one else has confirmed that number.

Does it affect Mac or Linux?

The malware described is Windows software. It goes after Windows Defender, User Account Control and Windows processes. The sources do not describe Mac or Linux versions.

Can I get infected just by downloading a repository?

The sources do not describe downloading on its own as the trigger. They describe the code running when a project is opened, built or run, and in some Visual Studio projects a pre-build event runs it before compilation. Treat opening an unknown project in Visual Studio as the same as running it.

How do I tell if a GitHub project is fake?

Be careful with tools that promise a lot in a beginner-friendly package from an account you do not know. Scroll all the way right in source files, check project files for build events, and look for long stretches of blank space hiding code.

Who is behind it?

No one knows. Neither Doctor Web's indicator list nor the news reports name a group.

The bigger lesson

Free code from the internet is a supply chain like any other. Any tool your team downloads runs with their access, so a fake one is a direct line into your servers and accounts. Treat unfamiliar repositories like an email attachment from a stranger: test them somewhere disposable first, and keep the logins that matter off the machines where that testing happens.

Want your developer machines and servers locked down? See security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at security alerts.

Sources: Doctor Web indicators of compromise for Trojan.Loader.3261; BleepingComputer; Security Affairs.