Malicious GitHub Projects Target Security Professionals and Crypto Users
Fake security tools are compromising over 2,000 Windows systems with advanced malware payloads.
1Widespread GitHub Malware Campaign
A sophisticated campaign has infected over 2,000 Windows PCs using malicious GitHub projects disguised as security utilities. Initially targeting blockchain enthusiasts with fake game bots, the attackers have shifted focus to cybersecurity professionals. These projects promise automated scanning and log analysis but instead deploy stealthy, multi-stage malware onto victim machines.
2Deceptive Delivery and Execution
Attackers embed malicious code within build scripts and configuration files, triggering infection when users attempt to compile or run the tools. By providing installation instructions, they lower the barrier for entry. Malicious payloads are hidden using large blocks of blank spaces in Python and Go files to evade detection.
3System Defense Neutralization
Once executed, the malware systematically dismantles host security. It disables Windows Defender, User Account Control, and System Restore while removing third-party antivirus products like McAfee and ESET. The loader further secures its persistence by adding custom Defender exclusions and patching event tracing in memory to remain hidden from security monitoring tools.
4Multi-Layered Payload Architecture
The primary component, a modular Electron-based application named Microsoft.exe, acts as a sophisticated loader. It communicates with various platforms like Telegram and Pastebin to retrieve encrypted payloads. These include AsyncRAT for remote access, a clipper that hijacks cryptocurrency wallet addresses, and a stealer targeting browser data, VPN settings, and messenger files.
5Advanced Evasion Mechanisms
The malware employs a primary execution mode, Mode3, which utilizes direct system calls and removes security hooks from ntdll.dll. If these evasion techniques fail, the system falls back to Mode2, which uses PowerShell-based injection. These methods ensure the malware maintains control over the compromised system while blocking access to antivirus vendor domains.
6Evolution of Malicious Infrastructure
Attackers are actively developing new features to ensure long-term persistence. Researchers identified an unfinished component designed to install itself as a system service, allowing it to re-download the main executable if deleted. This indicates a commitment to maintaining a permanent foothold on infected devices through continuous updates and modular code improvements.
7Risk of Public Repositories
This campaign highlights that public visibility on platforms like GitHub does not guarantee code safety. Users often mistake the open-source nature of these projects for inherent trustworthiness. Downloading and running unfamiliar security utilities from unverified repositories creates a significant attack vector, as malicious code can be hidden in plain sight.
8Defensive Best Practices
To mitigate these risks, experts recommend maintaining updated antivirus software and scanning every downloaded file before execution. Because the malware specifically targets security professionals, even experienced users must exercise caution with third-party tools. Vigilance regarding the source of development projects and build scripts remains the primary defense against such sophisticated threats.