Two-year GitHub campaign now uses fake security tools to infect 2,000+ Windows hosts with AsyncRAT, a clipper and a stealer

Linha do tempo

1. gbhackers.com ↗ · pub. 07/11/2026 03:06 · coletado 07/11 05:00

   Doctor Web: trojanized GitHub repositories posing as security tools infect 2,000+ systems with AsyncRAT, clipper and stealer

   ler a análise desta fonte ocultar

   Doctor Web disclosed on 5 November 2026 a long-running campaign that seeds GitHub repositories disguised as useful developer and security utilities — scanning automation, security testing and log analysis tools — alongside earlier lures aimed at blockchain games, crypto bots and cheats, with more than 2,000 computers infected. Victims are cybersecurity professionals and cryptocurrency/blockchain gaming users who clone and build the projects, triggering execution of a PowerShell downloader and an Electron-based loader chain. The final payloads are two AsyncRAT instances on different ports, a cryptocurrency clipper and a credential stealer. Doctor Web states the operation began roughly two years earlier and only later expanded to information security developers (news.drweb.com, mallory.ai). The abuse of legitimate services (YouTube, Telegram, Google Docs, GitCode, Pastebin) for dead-drop configuration and the heavy anti-EDR tooling make this a credible, high-urgency threat to developer workstations.

   Technical Details

   Malicious .csproj files embed PreBuildEvent routines that run before compilation, and .suo files carry PowerShell commands; Python and Go variants hide malicious statements behind long whitespace padding to defeat casual source review. Repository README instructions on installing Visual Studio and cloning lower the barrier to execution. Execution drops PowerShell.Packed.270 (e.g. C:\Users\Public\Pictures\t.ps1), which decrypts a string fetched from attacker infrastructure or legitimate services to obtain the Quixo.7z URL; Doctor Web notes the archive may also be hosted on GitHub itself (news.drweb.com). Contents unpack to C:\ProgramData\Windows.Microsoft.Photos, delivering Microsoft.exe (Trojan.Loader.3261), which then downloads Nexara.7z with encrypted modules and configuration; the decryption keys are stored in Nexara/manifest/config.json as b_f, k_f and t_f (news.drweb.com). The loader's Mode3 path combines PPID spoofing (setting explorer.exe as parent), Smart App Control tampering via VerifiedAndReputablePolicyState, ntdll.dll unhooking and Halo's Gate direct syscalls, plus AMSI/ETW patching of AmsiScanBuffer and EtwEventWrite. Decrypted boot_f, kernel_f and thread_f payloads are injected into RegAsm.exe, dwwin.exe or dwm.exe; on failure Mode2 rebuilds PowerShell.Inject.245 from encrypted thumbcache DLLs, while Mode3non and Handler provide further paths. Trojan.InjectNET.14 injects Trojan.Clipper.688 into regasm.exe to swap cryptocurrency wallet addresses and send screenshots over Telegram. The Electron-based JS.Stealer.191 runs virtualization and sandbox checks before harvesting browser passwords, cookies, autofill, Discord tokens, VPN configurations and messaging files, as well as FileZilla XML files, MobaXterm.ini and Total Commander's wcx_ftp.ini, exfiltrating a compressed archive through an attacker-controlled Telegram bot. Doctor Web tracks the backdoors as BackDoor.AsyncRAT.115 (news.drweb.com) and lists weaponized source files including FscanOutput_v2.2.py and resource.go (cyberpress.org). Persistence uses scheduled tasks and registry Run keys; the loader escalates privileges, disables Defender, UAC, System Restore and VSS, adds Defender exclusions (news.drweb.com), attempts to uninstall ESET, McAfee and Malwarebytes, and blackholes antivirus domains through the hosts file.

   Remediation

   Treat cloned repositories as untrusted code: inspect .csproj pre-build events and .suo files before opening a solution in Visual Studio, and review Python/Go sources with whitespace rendering enabled. Hunt for C:\ProgramData\Windows.Microsoft.Photos, C:\Users\Public\Pictures\t.ps1, injections into RegAsm.exe, dwwin.exe and dwm.exe, tampering with VerifiedAndReputablePolicyState, hosts-file entries redirecting antivirus domains, and outbound traffic to the published domains muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com and muckdeveloper[.]com. Build untrusted projects only in isolated, instrumented VMs, and alert on Defender/UAC/VSS being disabled or security products being uninstalled.

2. bleepingcomputer.com ↗ · pub. 06/11/2026 15:46 · coletado 06/11 17:00 primeiro registro

   Dr.Web: two-year GitHub campaign pivots to fake security tooling, infecting 2,000+ Windows hosts with AsyncRAT, clipper and stealer

   ler a análise desta fonte ocultar

   Doctor Web has detailed a GitHub supply-chain campaign that now targets information security professionals with trojanised repositories posing as scanning automation, security-testing and log-analysis tooling, after two years of luring blockchain-game, bot and cheat users. At the time of Doctor Web's research more than 2,000 PCs were infected (news.drweb.com). One decoy repository advertises a lightweight script to parse, clean and format output from the Fscan network scanner; Dr.Web's indicator list names it as Trivexqbk/FscanOutput-Beautify (github.com/DoctorWebLtd). The chain ends in an Electron-based modular loader (Microsoft.exe, Trojan.Loader.3261) that deploys the AsyncRAT backdoor, a clipboard clipper for crypto wallet addresses and an infostealer exfiltrating via a Telegram bot. No vulnerability is exploited — infection requires the victim to clone and build or run the attacker's project — but the loader's defence-evasion and antivirus-removal routines make a successful compromise deep and persistent.

   Technical Details

   Malicious code is hidden behind long runs of whitespace in Visual Studio project files, Python and Go sources. Dr.Web found malicious code in .suo and .csproj files as well as Python and Go source files; the .csproj carries a PreBuildEvent routine that runs the code before the project is compiled, and the .suo files contain a PowerShell command (news.drweb.com). The first-stage PowerShell script (PowerShell.Packed.270), dropped to paths such as C:\Users\Public\Pictures\t.ps1 and L.ps1, queries both attacker servers and legitimate platforms — YouTube, Telegram, Google Docs, GitCode and Pastebin — to retrieve an encrypted string that decrypts to the download link for the Quixo.7z archive, unpacked to C:\ProgramData\Windows.Microsoft.Photos (news.drweb.com).

   Trojan.Loader.3261 downloads Nexara.7z with the encrypted payloads and configuration, relays system information to a Telegram bot, elevates privileges, disables Windows Defender, UAC, notifications, System Restore and VSS, adds Defender exclusions, removes McAfee, ESET and Malwarebytes, and modifies the hosts file (news.drweb.com). Its default Mode3 chains PPID spoofing on explorer.exe, a Smart App Control bypass via the VerifiedAndReputablePolicyState registry value, ntdll.dll unhooking from disk, Halo's Gate direct syscalls, an ETW patch on EtwEventWrite and an AMSI patch on AmsiScanBuffer. If successful it injects into RegAsm.exe, dwwin.exe or dwm.exe using the encrypted modules boot_f, kernel_f and thread_f, whose keys sit in Nexara/manifest/config.json; a fallback Mode2 adds regasm.exe and dwm.exe as Defender exclusions and uses PowerShell.Inject.245 to decrypt and inject into RegAsm.exe, with further Mode3non and Handler variants (news.drweb.com).

   Payloads are two identical BackDoor.AsyncRAT.115 files differing only in network port — apparently so two operators can control one device at once — and Trojan.InjectNET.14, which injects Trojan.Clipper.688 into regasm.exe to swap crypto wallet addresses in the clipboard while taking screenshots sent to the Telegram bot with the clipper version, active window title, user login and device IP (news.drweb.com). JS.Stealer.191 checks for sandbox or virtual machine execution and steals browser data, FileZilla XML files, MobaXterm.ini, Total Commander's wcx_ftp.ini, VPN settings, messenger files, gaming and game-platform account data and Discord tokens (news.drweb.com). It also deletes files and folders in system32\drivers\etc\ outside a whitelist to hinder backups (news.drweb.com). Unused routines point to a forthcoming Lodge.7z Electron project (WUDFHost.exe) that would create a service via sc.exe for Microsoft.exe persistence, re-download it if missing, control startup and handle updates (news.drweb.com).

   Remediation

   Treat untrusted GitHub projects as code execution: never build a cloned Visual Studio solution without inspecting .csproj PreBuildEvent entries and .suo files, and review Python/Go sources for code hidden after long whitespace padding. Hunt for PowerShell writing to C:\Users\Public\Pictures\*.ps1, archive extraction to C:\ProgramData\Windows.Microsoft.Photos, injection into RegAsm.exe, dwm.exe and dwwin.exe, new Defender exclusions, changes to VerifiedAndReputablePolicyState, and tampering with system32\drivers\etc\. Block the network indicators published by Doctor Web (github.com/DoctorWebLtd/malware-iocs). Doctor Web advises keeping antivirus databases updated and scanning all files downloaded from the internet, and states its Dr.Web products detect and remove the malware (news.drweb.com).