Doctor Web: trojanized GitHub repositories posing as security tools infect 2,000+ systems with AsyncRAT, clipper and stealer

Linha do tempo

1. gbhackers.com ↗ · pub. 07/11/2026 03:06 · coletado 07/11 05:00 primeiro registro

   Doctor Web: trojanized GitHub repositories posing as security tools infect 2,000+ systems with AsyncRAT, clipper and stealer

   ler a análise desta fonte ocultar

   Doctor Web disclosed on 5 November 2026 a long-running campaign that seeds GitHub repositories disguised as useful developer and security utilities — scanning automation, security testing and log analysis tools — alongside earlier lures aimed at blockchain games, crypto bots and cheats, with more than 2,000 computers infected. Victims are cybersecurity professionals and cryptocurrency/blockchain gaming users who clone and build the projects, triggering execution of a PowerShell downloader and an Electron-based loader chain. The final payloads are two AsyncRAT instances on different ports, a cryptocurrency clipper and a credential stealer. Doctor Web states the operation began roughly two years earlier and only later expanded to information security developers (news.drweb.com, mallory.ai). The abuse of legitimate services (YouTube, Telegram, Google Docs, GitCode, Pastebin) for dead-drop configuration and the heavy anti-EDR tooling make this a credible, high-urgency threat to developer workstations.

   Technical Details

   Malicious .csproj files embed PreBuildEvent routines that run before compilation, and .suo files carry PowerShell commands; Python and Go variants hide malicious statements behind long whitespace padding to defeat casual source review. Repository README instructions on installing Visual Studio and cloning lower the barrier to execution. Execution drops PowerShell.Packed.270 (e.g. C:\Users\Public\Pictures\t.ps1), which decrypts a string fetched from attacker infrastructure or legitimate services to obtain the Quixo.7z URL; Doctor Web notes the archive may also be hosted on GitHub itself (news.drweb.com). Contents unpack to C:\ProgramData\Windows.Microsoft.Photos, delivering Microsoft.exe (Trojan.Loader.3261), which then downloads Nexara.7z with encrypted modules and configuration; the decryption keys are stored in Nexara/manifest/config.json as b_f, k_f and t_f (news.drweb.com). The loader's Mode3 path combines PPID spoofing (setting explorer.exe as parent), Smart App Control tampering via VerifiedAndReputablePolicyState, ntdll.dll unhooking and Halo's Gate direct syscalls, plus AMSI/ETW patching of AmsiScanBuffer and EtwEventWrite. Decrypted boot_f, kernel_f and thread_f payloads are injected into RegAsm.exe, dwwin.exe or dwm.exe; on failure Mode2 rebuilds PowerShell.Inject.245 from encrypted thumbcache DLLs, while Mode3non and Handler provide further paths. Trojan.InjectNET.14 injects Trojan.Clipper.688 into regasm.exe to swap cryptocurrency wallet addresses and send screenshots over Telegram. The Electron-based JS.Stealer.191 runs virtualization and sandbox checks before harvesting browser passwords, cookies, autofill, Discord tokens, VPN configurations and messaging files, as well as FileZilla XML files, MobaXterm.ini and Total Commander's wcx_ftp.ini, exfiltrating a compressed archive through an attacker-controlled Telegram bot. Doctor Web tracks the backdoors as BackDoor.AsyncRAT.115 (news.drweb.com) and lists weaponized source files including FscanOutput_v2.2.py and resource.go (cyberpress.org). Persistence uses scheduled tasks and registry Run keys; the loader escalates privileges, disables Defender, UAC, System Restore and VSS, adds Defender exclusions (news.drweb.com), attempts to uninstall ESET, McAfee and Malwarebytes, and blackholes antivirus domains through the hosts file.

   Remediation

   Treat cloned repositories as untrusted code: inspect .csproj pre-build events and .suo files before opening a solution in Visual Studio, and review Python/Go sources with whitespace rendering enabled. Hunt for C:\ProgramData\Windows.Microsoft.Photos, C:\Users\Public\Pictures\t.ps1, injections into RegAsm.exe, dwwin.exe and dwm.exe, tampering with VerifiedAndReputablePolicyState, hosts-file entries redirecting antivirus domains, and outbound traffic to the published domains muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com and muckdeveloper[.]com. Build untrusted projects only in isolated, instrumented VMs, and alert on Defender/UAC/VSS being disabled or security products being uninstalled.