- Doctor Web found fake GitHub projects, now aimed at security professionals, that install a backdoor, a crypto-address swapper and a data stealer. It counted more than 2,000 infected PCs.
- Opening and building a project can run attacker code, so a download from a trusted platform still needs vetting like any software.
- Teams should set rules for where security tools come from and where they are first tested.
Security teams spend their days deciding what not to trust. Yet a free script that promises to tidy scanner output is the kind of thing a busy analyst downloads without a second thought. That habit is the opening this campaign uses.
Researchers at Doctor Web found infected GitHub repositories built as Microsoft Visual Studio projects. At the time of their research, more than 2,000 PCs were infected. The company says the first infected repositories appeared two years ago, aimed at crypto wallet users.
From game cheats to security tools
The early repositories targeted crypto wallet users. They were presented as projects for blockchain games, game bots and cheating. Doctor Web says the attackers even added instructions for installing Visual Studio and cloning the repository, so people with little IT background could follow along.
The target has now widened. Doctor Web says the booby-trapped projects now pose as helpers for automating scans, testing security systems and analysing logs. One example is a script that claims to parse, clean and format output from Fscan, a network scanner.
One caveat matters. The sources do not say how many of the 2,000 victims work in security. The count covers the campaign as a whole.
How a project becomes an infection
The mechanism is the lesson. In the Visual Studio projects, the .csproj file carries a PreBuildEvent routine. That is a step the tool runs before it compiles the code. A developer who builds the project has already run the attacker's code. Doctor Web also found a PowerShell command inside .suo files, which store a user's project settings.
In Python and Go files, the malicious code hides behind a large number of whitespace characters. A reviewer skimming the file sees nothing odd. BleepingComputer calls this an old technique that still works.
Once triggered, a PowerShell script contacts the attackers' servers. It can also query legitimate platforms, including YouTube, Telegram, Google Docs, GitCode and Pastebin. It fetches an encrypted string that decrypts into a download link. That link leads to an archive, which unpacks into a Windows folder named Windows.Microsoft.Photos.
The archive holds a loader built with Electron, a framework for desktop apps. Doctor Web tracks it as Trojan.Loader.3261, and the latest version it saw was 1.4.5. It disables Windows Defender, User Account Control, System Restore and shadow copies. It also creates a Windows service so the file Microsoft.exe restarts and is downloaded again if deleted.
A loader that dismantles endpoint defences
The loader's evasion list reads like a catalogue of how endpoint detection and response (EDR) tools work. Doctor Web describes it removing hooks that EDR software places in the ntdll.dll system library. It calls Windows functions directly to avoid interception. It also patches Windows' event tracing and the antimalware scan interface that lets antivirus inspect scripts.
The trojan also tries to uninstall ESET, McAfee and Malwarebytes. It edits the hosts file so antivirus vendors' domains stay unreachable. It deletes most files in the same folder, which Doctor Web says stops users from creating and using backups.
These techniques are generic. Doctor Web describes one chain for the whole campaign and does not say these techniques were tailored to security staff. They would hit any victim's security software. That is why a defender's workstation is a poor place to run untrusted tools.
What the attacker walks away with
Three payloads follow. The first is AsyncRAT, a remote access backdoor, installed as two identical copies on different network ports. Doctor Web says this supposedly lets two operators control one device at the same time.
The second is a clipper. It swaps crypto wallet addresses in the clipboard and sends screenshots to the attackers' Telegram bot. The third is a stealer. BleepingComputer lists what it takes: browser data, VPN settings, FTP client config files, gaming accounts and Discord tokens. Doctor Web says the stolen data is compressed and sent to the attackers through a Telegram bot.
VPN settings and browser data could give an attacker a way into an employer.
Doctor Web also found unused routines that point to an unfinished component. It reads this as a sign the authors are still adding features.
What to ask your team
The lesson here is that trust in a platform does not transfer to the files on it. A GitHub listing says where code is hosted. It does not say who wrote it or what it does when built.
Leaders can put four questions to their security and engineering leads:
• Where may analysts get scanning and log-analysis tools, and who approves them? • Are new tools first run on an isolated machine, not on a workstation with VPN access and saved sessions? • Does anyone read build files such as .csproj before a project is built? • Can the team confirm which hosts hold the indicators of compromise Doctor Web published?
Doctor Web's own advice is to keep antivirus databases current and scan downloads. It also says its products detect this malware. Given the loader's tamper-and-uninstall behaviour, that advice is a floor, not a plan.
A tool that arrives free and fits a task today is also a tool someone chose to make attractive. Treat it as you would any code from a stranger.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Doctor Web (Dr.Web).
