Security professionals are being targeted with fake security tools on GitHub that infect their computers with a backdoor and an information stealer, researchers have warned.

The campaign began about two years ago targeting crypto wallet users with malicious blockchain games, bots and cheat tools. It has recently switched focus to cybersecurity professionals, publishing repositories that claim to automate scans, run security tests and analyse logs. Researchers at security company Dr. Web found that more than 2,000 Windows systems have been compromised so far.

One malicious repository is a fake script advertised as a lightweight way to parse, clean and format output from Fscan, a popular network scanner. The malicious code is hidden in Visual Studio project files, Python scripts and Go source files, concealed behind long stretches of whitespace. In some Visual Studio projects, a pre-build event runs the code before the project is even compiled.

The infection chain uses PowerShell to fetch an encrypted download link for a modular Electron-based loader disguised as "Microsoft.exe". The loader establishes persistence, raises its privileges, disables Windows security and recovery features, and injects the next stage of malware into legitimate processes.

Dr. Web describes six evasion techniques in the loader's default mode: it makes Explorer appear to be the malware's parent process, disables Smart App Control, restores original system code to remove security software hooks, makes direct system calls that are harder to intercept, and patches event tracing and antivirus scanning in memory. If that mode fails, a fallback mode adds Microsoft Defender exclusions and injects payloads into a system process.

The final payloads are the AsyncRAT backdoor, clipper malware that swaps crypto wallet addresses in the clipboard, and an information stealer that collects browser data, VPN settings, FTP client files, gaming account data and Discord tokens, sending them out through a Telegram bot. The malware also tries to remove ESET, McAfee and Malwarebytes antivirus tools and interfere with Windows backups.

Sources: BleepingComputer, reporting Dr. Web research.