Fake GitHub security tool repos spread AsyncRAT, Doctor Web reports

What happened

According to a Doctor Web investigation dated November 5, as reported by GBHackers, threat actors are distributing malware through GitHub repositories that pose as security utilities. Doctor Web says more than 2,000 computers were infected. This advisory relies on one news report summarising Doctor Web’s findings. The list of affected repositories, the accounts behind them and any action by GitHub are not confirmed in the source.

GBHackers reports that, per Doctor Web:

• The campaign targets cybersecurity professionals and blockchain gaming enthusiasts. It began with repositories promoting blockchain games, cryptocurrency bots and cheats, then expanded to scanning automation, security testing and log analysis tools.
• Malicious Visual Studio .csproj files contain PreBuildEvent routines that run before compilation, and .suo files carry PowerShell commands. Python and Go variants hide malicious statements behind long runs of whitespace.
• Execution starts a PowerShell downloader through scripts such as C:\Users\Public\Pictures\t.ps1. The downloader pulls encrypted strings from attacker infrastructure or legitimate services, including YouTube, Telegram, Google Docs, GitCode and Pastebin.
• A loader, Microsoft.exe (an Electron app), is extracted into C:\ProgramData\Windows.Microsoft.Photos and then fetches further encrypted modules.
• Final payloads reported are two AsyncRAT instances, a cryptocurrency clipper that replaces wallet addresses and sends screenshots over Telegram, and an Electron-based stealer. The stealer takes browser passwords, cookies, autofill data, Discord tokens, VPN configurations, messaging files and FileZilla, MobaXterm and Total Commander FTP config files, and exfiltrates them through a Telegram bot.
• The loader persists through scheduled tasks and registry Run entries. It tries to disable Defender, UAC, System Restore and VSS, tries to uninstall ESET, McAfee and Malwarebytes, and redirects antivirus domains through hosts-file changes.

Am I affected?

You may be affected if, on Windows, you cloned and built a Visual Studio project or ran a Python or Go script from a GitHub repository advertised as a security tool, blockchain game helper, crypto bot or cheat, per GBHackers.

Signs reported by Doctor Web via GBHackers:

• A file at C:\Users\Public\Pictures\t.ps1
• A folder C:\ProgramData\Windows.Microsoft.Photos containing Microsoft.exe
• Hosts-file entries that redirect antivirus domains
• Defender, UAC, System Restore or VSS unexpectedly disabled, or ESET, McAfee or Malwarebytes removed
• Network connections to muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com or muckdeveloper[.]com

Which specific repositories were malicious is not confirmed in the source.

What to do now

1. Before building any cloned Visual Studio project, open the .csproj and look for PreBuildEvent entries, and treat .suo files from unknown repos with suspicion, since these are the reported execution points (GBHackers).
2. For Python and Go scripts from unknown repos, check for code hidden past long whitespace runs (for example, scroll horizontally or search for very long lines), as described in the report.
3. Search your hosts and network logs for the four domains listed above, and check for the reported file paths.
4. If you find any indicator, isolate the machine. The reported stealer takes browser credentials, cookies, Discord tokens, VPN configs and FTP client settings, so rotate those credentials from a clean device.
5. If you handle cryptocurrency on an affected machine, verify pasted wallet addresses, because the reported clipper replaces them.
6. Check scheduled tasks and registry Run entries for unknown items, and confirm Defender and other security tools are running and unmodified.

Update, 9 November 2026

• Security Affairs, citing Doctor Web, says the campaign started two years ago with Visual Studio projects tied to blockchain games, game bots and cheats, and that the attackers supplied instructions for installing Visual Studio and downloading the projects from GitHub. (securityaffairs.com)
• Doctor Web found one fake security project that pretends to analyze and clean results from the Fscan security scanner. (securityaffairs.com)
• Doctor Web says the loader’s default evasion mode, Mode3, fakes the parent process, disables Smart App Control, removes security software hooks from ntdll.dll, makes direct system calls and patches event tracing and antivirus script scanning in memory. If that fails, Mode2 adds Defender exclusions and injects through PowerShell. (securityaffairs.com)
• Doctor Web says the two AsyncRAT copies run on different ports, which probably lets two operators control one device. The loader also sends system information to a Telegram bot, adds its own Defender exclusions and injects code into legitimate processes. (securityaffairs.com)
• Doctor Web found an unfinished Electron component, WUDFHost.exe, delivered via an archive named Lodge.7z. It could install itself as a system service, re-download Microsoft.exe if deleted, manage startup and install updates. Doctor Web advises keeping antivirus up to date and scanning every downloaded file. (securityaffairs.com)

Sources

• GBHackers: Hackers Use Fake GitHub Security Tools to Spread Malware, Infecting Over 2,000 Computers
• securityaffairs.com: Fake GitHub Security Tools Infect Over 2,000 PCs With Malware