Cybersecurity professionals are being targeted with malicious projects on GitHub disguised as legitimate security tools, researchers have warned. The fake repositories deploy backdoor and information-stealing malware, and more than 2,000 Windows systems have been compromised so far, according to cybersecurity company Dr.Web, whose findings were reported on 6 November.

The campaign began about two years ago and first targeted cryptocurrency wallet users, but the threat actor has recently switched focus, publishing malicious repositories for automating scans, security testing and log analysis. One example found by researchers is a fake script advertised as a lightweight way to parse, clean and format output from the Fscan network scanner.

How the infection works

Dr.Web found malicious code embedded in Visual Studio project files, Python scripts and Go source files, hidden behind long stretches of whitespace. The infection chain uses PowerShell to retrieve an encrypted download link that fetches a modular Electron-based loader named Microsoft.exe. The final payloads are the AsyncRAT backdoor, clipper malware that replaces cryptocurrency wallet addresses copied to the clipboard, and an information stealer known as JS.Stealer.191.

What the malware steals

The infostealer collects browser data, VPN settings, FTP client configuration files, gaming account information and Discord tokens, and sends the stolen details out through a Telegram bot. The malware also attempts to remove ESET, McAfee and Malwarebytes security products from infected machines. Dr.Web has published a list of indicators of compromise for the campaign. The attack is a reminder that even tools aimed at security experts can be poisoned: code downloaded from public repositories should be reviewed before it is run, especially when it arrives with promises of a quick shortcut.