Security professionals are being targeted with malicious GitHub projects that pose as security tools and deploy a backdoor and information stealers. Russian vendor Dr.Web reports more than 2,000 compromised Windows systems so far.
The Campaign
The activity has run for about two years. The actor first went after crypto wallet users and gaming and blockchain enthusiasts using fake games, bots and cheat tools. It has since shifted to repositories posing as tools for automated scanning, security testing and log analysis.
One example is a fake script that claims to parse, clean and format output from the Fscan network scanner.
How the Malware Hides
Dr.Web found malicious code in Visual Studio project files, Python scripts and Go source files, hidden behind long runs of whitespace. In some Visual Studio projects, a pre-build event runs the code before compilation.
Infection Chain
- PowerShell retrieves an encrypted download link.
- The link fetches a modular Electron-based loader named
Microsoft.exe. - The loader sets up persistence, elevates privileges, disables Windows security and recovery features, and injects the next stage into legitimate processes.
- In its default Mode3, it uses six evasion techniques. These include spoofing
explorer.exeas the parent process, disabling Smart App Control, restoringntdll.dllto remove security hooks, direct system calls, and patchingEtwEventWriteandAmsiScanBufferin memory. - If Mode3 fails, Mode2 adds Microsoft Defender exclusions and injects payloads into
RegAsm.exe.
Final Payloads
- AsyncRAT backdoor
- A clipper that swaps crypto wallet addresses in the clipboard
- An infostealer that collects browser data, VPN settings, FTP configurations, gaming account data and Discord tokens, and exfiltrates it through a Telegram bot
The malware also tries to remove ESET, McAfee and Malwarebytes, cut them off from update servers, and interfere with Windows backups. Dr.Web found an unfinished component that could re-download the loader if it is removed, which suggests active development.
Indicators and Attribution
Dr.Web published indicators under Trojan.Loader.3261 in its malware-iocs GitHub repository. No threat actor has been named.
Recommendations
- Vet GitHub tools before running them. Read build scripts and project files, and run unknown tools only in an isolated VM.
- Search for unusually long whitespace runs and pre-build events in project files.
- Monitor for unexpected PowerShell activity and new Defender exclusions.
- Check systems against the published IOCs.