Fake security tools on GitHub push backdoors and infostealers
Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware.
Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware.
The infection chain uses PowerShell to retrieve an encrypted download link that fetches a modular Electron-based loader named ‘Microsoft.exe.’ The loader establishes persistence on the infected host, elevates its privileges, disables Windows security and recovery features, and injects the next-stage (malware) into legitimate processes.
The campaign started about two years ago and initially targeted crypto wallet users, but recently the threat actor switched focus and published malicious repositories for automating scans, security testing, and log analysis.
The researchers shared a complete list of indicators of compromise observed in this campaign.
Web, the malware also attempts to remove ESET, McAfee, and Malwarebytes antivirus tools from the infected computer, tries to disconnect them from their update servers, and also interferes with Windows backups.
The infostealer collects browser data, VPN settings, FTP client configuration files, gaming account data, and Discord tokens, and exfiltrates the details through a Telegram bot.
Web describes six evasion techniques in the loader’s Mode3 mode, which is its default operational mode: If that mode fails to launch, the loader uses Mode2, which adds Microsoft Defender exclusions and uses a PowerShell script to decrypt and inject the payloads into ‘RegAsm.exe.’ The final payloads delivered to the host are the AsyncRAT backdoor, clipper malware that replaces crypto wallet addresses in the clipboard, and an information stealer.
One malicious repository they found is a fake script advertised as a lightweight solution to parse, clean, and format output from the Fscan network scanner.
Previous lures included blockchain games, bots, and cheat tools, typically targeting blockchain and game enthusiasts; this finding suggests that the threat actor is working to improve the malware with new features.
Web's investigation found malicious code embedded in Visual Studio project files, Python scripts, and Go source files, hidden behind long stretches of whitespace, an old technique that still proves effective.
What happened
Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware.
The infection chain uses PowerShell to retrieve an encrypted download link that fetches a modular Electron-based loader named ‘Microsoft.exe.’ The loader establishes persistence on the infected host, elevates its privileges, disables Windows security and recovery features, and injects the next-stage (malware) into legitimate processes.
What changed
The campaign started about two years ago and initially targeted crypto wallet users, but recently the threat actor switched focus and published malicious repositories for automating scans, security testing, and log analysis.
The researchers shared a complete list of indicators of compromise observed in this campaign.
Who is affected
Web, the malware also attempts to remove ESET, McAfee, and Malwarebytes antivirus tools from the infected computer, tries to disconnect them from their update servers, and also interferes with Windows backups.
The infostealer collects browser data, VPN settings, FTP client configuration files, gaming account data, and Discord tokens, and exfiltrates the details through a Telegram bot.
Why it matters
Web describes six evasion techniques in the loader’s Mode3 mode, which is its default operational mode: If that mode fails to launch, the loader uses Mode2, which adds Microsoft Defender exclusions and uses a PowerShell script to decrypt and inject the payloads into ‘RegAsm.exe.’ The final payloads delivered to the host are the AsyncRAT backdoor, clipper malware that replaces crypto wallet addresses in the clipboard, and an information stealer.
One malicious repository they found is a fake script advertised as a lightweight solution to parse, clean, and format output from the Fscan network scanner.
Technical details
Previous lures included blockchain games, bots, and cheat tools, typically targeting blockchain and game enthusiasts; this finding suggests that the threat actor is working to improve the malware with new features.
Web's investigation found malicious code embedded in Visual Studio project files, Python scripts, and Go source files, hidden behind long stretches of whitespace, an old technique that still proves effective.
Attribution
BleepingComputer: Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware.
What to watch next
Watch for updated vendor guidance and fixed-version details.