Doctor Web has reported that malware hidden in GitHub projects posing as security tools has infected more than 2,000 computers. The campaign, described as ongoing and about two years old, began by targeting blockchain game fans and now aims at information security professionals.
Trojanized Repositories Posing as Scanning and Log-Analysis Tools
Doctor Web found malware inside GitHub projects presented as security tools for automated scanning, testing and log analysis. One example pretended to clean Fscan results. Earlier lures in the campaign were Visual Studio projects for blockchain games, bots and cheats.
Where the Malicious Code Hides
The malicious code sits in pre-build commands, in PowerShell inside configuration files, and in Python and Go files padded with blank space. Some of the fake tools also remove installed antivirus software.
Multi-Stage Infection Chain Through YouTube, Telegram and Pastebin
The PowerShell script contacts attacker servers as well as YouTube, Telegram, Google Docs, GitCode and Pastebin. It retrieves an encrypted link to an archive disguised as a Windows Photos component. The archive contains Microsoft.exe, an Electron-based modular loader.
What the Electron Loader Does After Launch
The loader sends system information to a Telegram bot, establishes persistence and escalates privileges. It disables Defender, UAC, System Restore and shadow copies, adds Defender exclusions, injects into legitimate processes and removes McAfee, ESET and Malwarebytes.
Mode3 Evasion Techniques and the Mode2 Fallback
By default the loader runs a mode called Mode3, which fakes the parent process, disables Smart App Control, unhooks ntdll.dll, uses direct system calls and patches ETW and script scanning. Mode2 serves as the fallback if Mode3 does not work.
The techniques target the visibility defenders rely on. Unhooking ntdll.dll and using direct syscalls bypass the monitoring that security products place on system calls, while patching ETW removes a telemetry source used for detection. The combination suggests a deliberate effort to operate on machines that run endpoint protection.
Why Researchers Have Become the Target
The campaign’s shift from game cheats to security tooling matters because of who downloads such projects. Security professionals routinely fetch and run unfamiliar tools from GitHub, often on machines with access to sensitive environments. A trojanized scanner or log-analysis utility reaches them in a form they have a reason to run.
Open Details in the Doctor Web Report
The report as described does not state how victims are directed to the fake repositories, which countries the 2,000-plus infected machines are in, or what the attackers do with the access. Doctor Web publishes indicators of compromise. The sources do not name an actor behind the campaign.
The disclosure is new, although the activity is not: the campaign is about two years old and the news event is Doctor Web’s report on its scale and tooling. The figure of more than 2,000 infections gives a measure of how far trojanized repositories have spread, and the shift in lures illustrates how the operators adapt their bait to the audience they want to reach.
Scale and Persistence of the Two-Year Campaign
The campaign’s age is its notable feature. Described as about two years old, it has moved from game-related lures to security tooling while keeping its core technique of hiding code in places a casual reader will not look. Python and Go files padded with blank space push the malicious line out of view, and pre-build commands run before a developer examines the compiled result.
The loader’s removal of McAfee, ESET and Malwarebytes, alongside the disabling of Defender, shows a goal of leaving the machine without working endpoint protection. Its use of a Telegram bot to receive system information gives the operators a channel that blends in with ordinary web traffic.
The count of more than 2,000 infected PCs is Doctor Web’s figure. The company’s publication of indicators of compromise lets other defenders check for the same files and connections. The news event is the new report, since the activity itself is long-running.
