Fake Security Tools on GitHub Deploy Backdoors and Infostealers to Compromise Over 2,000 Windows Systems
What Happened — Researchers at Dr. Web uncovered a multi‑year campaign that publishes malicious repositories on GitHub masquerading as legitimate security utilities (e.g., a scanner‑output parser, log‑analysis helpers). The code is hidden in Visual Studio project files, Python scripts, and Go sources using whitespace obfuscation. When a victim clones and runs the project, a PowerShell routine pulls an encrypted download link that delivers an Electron‑based loader named Microsoft.exe. The loader gains persistence, elevates privileges, disables Windows security features, and injects the AsyncRAT backdoor, a clipboard‑clipping crypto‑wallet malware, and an information‑stealer. The stealer harvests browser data, VPN settings, FTP configs, gaming accounts, and Discord tokens, exfiltrating them via a Telegram bot. The loader also attempts to uninstall or block ESET, McAfee, and Malwarebytes, and it tampers with Windows backup mechanisms. Dr. Web estimates more than 2,000 Windows systems have been compromised since the campaign began roughly two years ago, initially targeting crypto‑wallet users before shifting to security‑tool seekers.
Why It Matters for Trust & Control Assurance — The incident highlights the need for robust third‑party risk controls and continuous monitoring of open‑source supply‑chain artifacts.
Who Is Affected — Developers and security professionals who consume open‑source tools from public repositories; organizations that rely on community‑authored security scripts, especially in the technology and financial‑services sectors.
Recommended Actions
- Enforce strict provenance checks (SBOMs, code‑signing verification) before integrating external code.
- Deploy automated scanning of third‑party repositories for hidden payloads and obfuscation patterns.
- Harden endpoint defenses: restrict PowerShell execution policies, enable application control, and monitor for unusual process trees (e.g., explorer.exe spawning unknown loaders).
- Maintain an incident‑response playbook for supply‑chain compromises.
Source: BleepingComputer
Technical Notes
- Attack vector: malicious GitHub repositories (third‑party dependency).
- Loader evasion techniques: process‑parent spoofing, registry tampering, direct system calls, ETW and AMSI patching, Defender exclusion creation.
- Payloads: AsyncRAT backdoor, clipboard‑clipping crypto‑wallet malware, multi‑type infostealer.