# Malicious GitHub Projects Target Security Professionals and Crypto Users

Fake security tools are compromising over 2,000 Windows systems with advanced malware payloads.

- **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb)
- **Published:** 2026-11-09
- **Topic:** [technology](https://brifing.si/c/technology)
- **Original article:** <https://securityaffairs.com/202717/malware/fake-github-security-tools-infect-over-2000-pcs-with-malware.html>
- **On Brifing:** https://brifing.si/s/4da9c6b9-d01e-4430-b2b1-dfadc88fa355

## Widespread GitHub Malware Campaign

A sophisticated campaign has infected over 2,000 Windows PCs using malicious GitHub projects disguised as security utilities. Initially targeting blockchain enthusiasts with fake game bots, the attackers have shifted focus to cybersecurity professionals. These projects promise automated scanning and log analysis but instead deploy stealthy, multi-stage malware onto victim machines.

## Deceptive Delivery and Execution

Attackers embed malicious code within build scripts and configuration files, triggering infection when users attempt to compile or run the tools. By providing installation instructions, they lower the barrier for entry. Malicious payloads are hidden using large blocks of blank spaces in Python and Go files to evade detection.

## System Defense Neutralization

Once executed, the malware systematically dismantles host security. It disables Windows Defender, User Account Control, and System Restore while removing third-party antivirus products like McAfee and ESET. The loader further secures its persistence by adding custom Defender exclusions and patching event tracing in memory to remain hidden from security monitoring tools.

## Multi-Layered Payload Architecture

The primary component, a modular Electron-based application named Microsoft.exe, acts as a sophisticated loader. It communicates with various platforms like Telegram and Pastebin to retrieve encrypted payloads. These include AsyncRAT for remote access, a clipper that hijacks cryptocurrency wallet addresses, and a stealer targeting browser data, VPN settings, and messenger files.

## Advanced Evasion Mechanisms

The malware employs a primary execution mode, Mode3, which utilizes direct system calls and removes security hooks from ntdll.dll. If these evasion techniques fail, the system falls back to Mode2, which uses PowerShell-based injection. These methods ensure the malware maintains control over the compromised system while blocking access to antivirus vendor domains.

## Evolution of Malicious Infrastructure

Attackers are actively developing new features to ensure long-term persistence. Researchers identified an unfinished component designed to install itself as a system service, allowing it to re-download the main executable if deleted. This indicates a commitment to maintaining a permanent foothold on infected devices through continuous updates and modular code improvements.

## Risk of Public Repositories

This campaign highlights that public visibility on platforms like GitHub does not guarantee code safety. Users often mistake the open-source nature of these projects for inherent trustworthiness. Downloading and running unfamiliar security utilities from unverified repositories creates a significant attack vector, as malicious code can be hidden in plain sight.

## Defensive Best Practices

To mitigate these risks, experts recommend maintaining updated antivirus software and scanning every downloaded file before execution. Because the malware specifically targets security professionals, even experienced users must exercise caution with third-party tools. Vigilance regarding the source of development projects and build scripts remains the primary defense against such sophisticated threats.

## Sources covering this story

- [Security Affairs — Fake GitHub Security Tools Infect Over 2,000 PCs With Malware](https://securityaffairs.com/202717/malware/fake-github-security-tools-infect-over-2000-pcs-with-malware.html)
- [cybersecurity — Fake GitHub Security Tools Distribute Backdoors and Cryptocurrency Malware](https://www.reddit.com/r/cybersecurity/comments/1xr0l2g/fake_github_security_tools_distribute_backdoors/)

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._