Fake GitHub security tools now target professionals with backdoors and infostealers
Developers and security staff who download booby-trapped repositories risk having their browser data, wallets and accounts taken.
A campaign spreading through GitHub is now aimed at security professionals, after first luring crypto wallet users. Researchers at Dr. Web say more than 2,000 Windows systems have been compromised, with the attacker publishing booby-trapped repositories for scan automation, security testing and log analysis. Hidden code sits in Visual Studio project files, Python scripts and Go source, with some projects running it in a pre-build step before compilation. The payload chain ends in AsyncRAT, a clipboard-swapping crypto wallet stealer, and an infostealer that harvests browser data, VPN and FTP settings, gaming accounts and Discord tokens, sending them out through a Telegram bot. Dr. Web also reports the malware tries to disable ESET, McAfee and Malwarebytes and interfere with Windows backups, and found an unfinished component suggesting the operator is still developing it.
Why it matters
The campaign started by luring crypto wallet users and has moved toward people who work in security, a group that would normally be expected to check code before running it. Repositories posing as scan automation, security testing or log analysis tools can carry the malware, so anyone who has cloned or run such projects on a Windows machine has reason to check them. The malware also tries to disable several antivirus products and interfere with Windows backups, which makes recovery harder for affected users.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.