Fake security tools posted on GitHub have infected more than 2,000 Windows computers with a backdoor, a cryptocurrency clipboard hijacker and an information stealer, researchers at Dr.Web reported on 5 November 2026.

The campaign began about two years ago targeting cryptocurrency users with fake blockchain games, bots and cheat tools. The operators have since switched focus to repositories aimed at cybersecurity professionals, advertising tools for scan automation, security testing and log analysis. One malicious repository posed as a lightweight script to parse, clean and format output from the Fscan network scanner.

Malicious code hides in Visual Studio project files, Python scripts and Go source files, concealed behind long stretches of whitespace. In some Visual Studio projects, a pre-build event routine runs the code before compilation, while .suo files carry PowerShell commands. PowerShell then fetches an encrypted download link for a modular Electron-based loader named Microsoft.exe.

Three payloads, one Telegram exfiltration route

The final payloads are the AsyncRAT backdoor, which gives attackers remote control of the machine, a clipper that swaps copied cryptocurrency wallet addresses for attacker-controlled ones, and an Electron-based information stealer, JS.Stealer.191. The stealer collects browser passwords, cookies and autofill data, VPN settings, FTP client files, gaming account data and Discord tokens, then sends them out through a Telegram bot.

The loader works hard to stay hidden. Dr.Web describes six evasion techniques in its default mode, including making explorer.exe appear to be its parent process, disabling Smart App Control, restoring the original ntdll.dll code from disk, and patching event-tracing and antivirus scanning functions in memory. It also tries to remove ESET, McAfee and Malwarebytes products, disable Windows Defender and System Restore, and interfere with backups. Dr.Web has published a list of indicators of compromise for the campaign.