Ethical Hacking News
Fake GitHub security tools have infected over 2,000 PCs with malware, compromising the integrity of users' devices. The attackers are targeting blockchain game enthusiasts and information security professionals, and are constantly updating the malware to introduce new features. Doctor Web advises users to stay vigilant and keep their antivirus software up to date to prevent falling victim to these fake security tools.
Over 2,000 PCs infected with malware via fake GitHub security tools. Attackers target blockchain game enthusiasts and information security professionals. Malware hides in project files, including commands that run before a project is built and PowerShell commands. Attackers remove antivirus software and contact attackers' servers and legitimate platforms. Malware collects system information, turns off Windows Defender, and injects code into legitimate processes. Attackers are constantly updating the malware to introduce new features. Users advised to keep antivirus software up to date and scan every file they download.
In a recent discovery, cybersecurity firm Doctor Web has found that fake GitHub security tools have infected over 2,000 PCs with malware. The attackers behind these compromised development projects target blockchain game enthusiasts and information security professionals. The campaign started two years ago with Visual Studio projects related to blockchain games, game bots, and cheats. The attackers hid malicious code in project files, including commands that ran before a project was built and PowerShell commands stored in configuration files. They even provided instructions on how to install Visual Studio and download the projects from GitHub, making it easy for people with limited technical knowledge to use them.
Now, the attackers are targeting cybersecurity professionals. Their new GitHub projects claim to offer tools for automated scanning, security testing, and log analysis. Doctor Web found one that pretends to analyze and clean results from the Fscan security scanner. The attackers also hide malicious code in Python and Go files, using large blocks of blank spaces to make it harder to spot. Some of these fake security tools even remove the antivirus software installed on the victim's computer.
Once a victim opens the project, a PowerShell script runs and contacts the attackers' servers and legitimate platforms, including YouTube, Telegram, Google Docs, GitCode, and Pastebin. An encrypted string it retrieves holds a link to an archive, which unpacks into a folder disguised as a Windows Photos component. Its main program is Microsoft.exe, a modular app built with the Electron framework. It does most of the damage. The loader collects system information and sends it to a Telegram bot, keeps itself running, raises its privileges, and turns off Windows Defender, UAC, System Restore, and shadow copies. It also adds its own Defender exclusions, injects code into legitimate processes, and removes McAfee, ESET, and Malwarebytes antivirus products.
Its default mode, called Mode3, stacks several evasion tricks. It fakes its parent process, disables Smart App Control, removes security software hooks from ntdll.dll, makes direct system calls, and patches event tracing and antivirus script scanning in memory. If that fails, Mode2 takes over, adding Defender exclusions and injecting through PowerShell. Three payloads follow:
* AsyncRAT, a remote access backdoor, runs as two identical copies on different ports, which probably lets two operators control one device.
* A clipper swaps crypto wallet addresses in the clipboard while taking screenshots.
* A stealer takes browser data, FileZilla, MobaXterm, and Total Commander configs, VPN settings, messenger files, game accounts, and Discord tokens. Everything is zipped and sent through Telegram, and the malware edits the hosts file to block antivirus vendors' domains.
The attackers are still developing the malware. Doctor Web found an unfinished component that could install itself as a system service, download Microsoft.exe again if someone deletes it, manage startup, and install updates.
"Attackers are constantly updating the Trojans to introduce new features. For example, Doctor Web's researchers discovered certain unused routines that facilitate downloading and decompressing yet another archive—Lodge.7z," concludes the report. "It contains an Electron project that hasn't been completed yet. The executable file's name is WUDFHost.exe. Its code offers us a glimpse of some of the trojan's future features."
Doctor Web advises users to keep their antivirus software up to date and scan every file they download. The researchers warn that attackers are constantly improving the Trojans and adding new features.
Related Information:
https://www.ethicalhackingnews.com/articles/Fake-GitHub-Security-Tools-A-Growing-Threat-to-Cybersecurity-ehn.shtml
https://securityaffairs.com/202717/malware/fake-github-security-tools-infect-over-2000-pcs-with-malware.html
Published: Mon Nov 9 05:01:10 2026 by llama3.2 3B Q4_K_M
