Fake security tools on GitHub push backdoors and infostealers

A cyber espionage campaign is distributing malicious security tools on GitHub to deploy backdoors and infostealers onto developer and analyst workstations. According to BleepingComputer's report detailing investigation findings from security firm Dr. Web, threat actors have compromised more than 2,000 Windows systems by disguising malware within fake repositories offering automated vulnerability scanning, log analysis, and network scan formatting.

This report breaks down the anatomy of the campaign, including the loader execution chain, multi-stage defense evasion techniques, and the downstream payloads delivered to infected hosts. It is designed for system administrators, security analysts, and developers seeking to understand how threat actors manipulate open-source development workflows and compromise developer endpoints through deceptive tooling.

Fake security tools on GitHub push backdoors: what actually changed

The threat actor launched this malicious campaign approximately two years ago, initially targeting cryptocurrency wallet holders through fraudulent blockchain games, automated bots, and game cheat tools. Recently, the operators pivoted their strategy toward cybersecurity professionals by publishing trojanized GitHub repositories advertised as automated tools for security testing, scanning, and log analysis. A notable example analyzed by Dr. Web involves a fake script promoted as a lightweight utility to parse, clean, and format output from the widely used Fscan network scanner.

Investigation by cybersecurity firm Dr. Web confirmed that more than 2,000 Windows machines have already been compromised during this ongoing campaign. To deceive researchers, the adversary embedded malicious code inside Visual Studio project files, Python scripts, and Go source files. The operators concealed this code behind extensive stretches of whitespace, a simple obfuscation technique that still proves remarkably effective at bypassing casual scrutiny. In certain Visual Studio repositories, pre-build event routines automatically execute the hidden code before the compilation process even starts.

Fake security tools on GitHub push backdoors: how it works

The infection chain relies on a hidden PowerShell script to retrieve an encrypted download link, which fetches a modular Electron-based loader named Microsoft.exe. Once launched, this loader establishes persistence on the host, elevates privileges, disables Windows security and recovery capabilities, and injects malicious code into legitimate processes. By default, the loader operates in Mode3 mode, which leverages six evasion techniques to blind defenses. If Mode3 fails, it falls back to Mode2, using PowerShell to add Microsoft Defender exclusions and inject payloads into RegAsm.exe.

Under Mode3, the loader makes explorer.exe appear as the parent process to evade detection hierarchy checks. It alters Windows registry settings to disable Smart App Control and restores the original ntdll.dll binary directly from disk to unhook security monitoring products. The malware also issues direct Windows system calls to bypass API interception routines. Furthermore, the loader patches EtwEventWrite in memory to suppress Event Tracing for Windows and patches AmsiScanBuffer in memory to prevent antivirus scanners from inspecting executing scripts.

Fake security tools on GitHub push backdoors: why it matters

The infection drops three distinct payloads onto the target system: the AsyncRAT backdoor, clipper malware, and an information stealer. AsyncRAT provides the attackers with persistent remote access and control over the compromised Windows endpoint. Meanwhile, the clipper component continuously monitors the operating system clipboard, automatically substituting legitimate cryptocurrency wallet addresses with attacker-controlled addresses during transactions. This dual-threat combination allows the operators to maintain persistent network access while simultaneously monetizing infections by redirecting financial transfers away from intended recipient addresses.

The included infostealer gathers browser data, VPN configuration settings, FTP client files, gaming account details, and Discord authentication tokens, exfiltrating the stolen credentials through a dedicated Telegram bot. To secure its foothold, the malware actively attempts to remove ESET, McAfee, and Malwarebytes security software from the infected machine. It also attempts to disconnect these antivirus products from their update servers and interferes with Windows backup features, leaving defenders without active endpoint monitoring or reliable system recovery options.

Fake security tools on GitHub push backdoors: who is affected

This campaign specifically targets cybersecurity professionals, penetration testers, system administrators, and software engineers who evaluate open-source utilities to automate security testing and log analysis. Attackers created lures tailored to daily security workflows, including scripts for formatting Fscan network scan output. Because security personnel typically operate workstations with elevated administrative privileges, local repository access, and connectivity to internal corporate networks, compromising these endpoints provides adversaries with an advantageous beachhead for deep corporate reconnaissance, lateral movement, and persistent network access across affected enterprise environments.

In addition to cybersecurity analysts, cryptocurrency traders and gaming enthusiasts remain at risk due to the campaign's earlier repositories distributing bots, blockchain games, and cheat tools. With more than 2,000 Windows machines compromised so far, the operational impact extends across individual users and organizations. Any user running affected projects risks the silent theft of browser credentials, Discord tokens, FTP configs, and VPN profiles. Furthermore, the active clipboard clipper places anyone copying cryptocurrency wallet addresses at immediate risk of transaction diversion and theft.

Fake security tools on GitHub push backdoors: what to watch

Dr. Web researchers uncovered an unfinished component inside the loader framework designed to maintain execution and automatically redownload Microsoft.exe if it is removed from the infected host's disk. This evidence reveals that the threat actor is actively enhancing the malware with new persistence capabilities and operational features. Defenders must watch for unexpected outbound connections to Telegram API endpoints and suspicious PowerShell commands retrieving encrypted files. Organizations should also scrutinize Visual Studio projects for unauthorized pre-build event routines and inspect script repositories for unusual stretches of whitespace.

Administrators must audit Windows endpoint logs for indicators of process injection into RegAsm.exe and explorer.exe, as well as unauthorized Defender exclusions created via PowerShell scripts. Security teams should confirm that Smart App Control remains active and verify that ntdll.dll in-memory hooks have not been stripped. Furthermore, organizations should inspect host security configurations to ensure ESET, McAfee, or Malwarebytes agents have not been uninstalled or cut off from their update servers, while confirming that Windows backup services continue to function without unauthorized administrative interference.