When Defenders Become Targets

The cybersecurity community is grappling with a deeply ironic threat: malware disguised as the very tools security professionals use to defend networks. Researchers at antivirus firm Dr. Web have uncovered a sprawling campaign on GitHub that has compromised over 2,000 Windows machines by packaging backdoors and information stealers inside repositories masquerading as legitimate security utilities.

The campaign, which began approximately two years ago initially targeting cryptocurrency wallet users, has recently pivoted to directly hunting the people tasked with keeping organizations safe. Fake repositories advertising network scanning automation, security testing frameworks, and log analysis tools are being published on GitHub with alarming regularity, and the threat actor behind them has refined their craft to a degree that makes detection extraordinarily difficult.

How the Attack Works

The infection chain begins with a seemingly helpful GitHub repository. One example discovered by researchers is a fake script advertised as a lightweight solution to parse, clean, and format output from the Fscan network scanner, a popular tool used by security teams for network reconnaissance. The repository looks legitimate, the README is well-written, and the code appears functional at first glance.

However, hidden within Visual Studio project files, Python scripts, and Go source files are long stretches of whitespace concealing malicious code. This is not a new technique, but it remains devastatingly effective. In some Visual Studio projects, a pre-build event routine executes the malicious code before compilation even begins, meaning the malware runs the moment a developer opens and builds the project.

Once triggered, the infection chain uses PowerShell to retrieve an encrypted download link. That link fetches a modular Electron-based loader named Microsoft.exe, which establishes persistence on the infected host, elevates its privileges, disables Windows security and recovery features, and injects subsequent malware payloads into legitimate processes to evade detection.

Six Layers of Evasion

What makes this campaign particularly dangerous is the sophistication of its evasion techniques. The loader operates in a default mode called Mode3, which employs six distinct evasion strategies:

• Process spoofing: Makes explorer.exe appear to be the malware’s parent process, masking its true origin
• Smart App Control disable: Modifies Windows registry values to disable Microsoft’s Smart App Control feature
• ntdll.dll restoration: Restores the original ntdll.dll code from disk, removing security hooks placed by endpoint detection and response software
• Direct syscalls: Makes direct Windows system calls that bypass user-mode API monitoring used by many security tools
• ETW patching: Patches EtwEventWrite in memory to suppress event tracing, blinding security monitoring
• AMSI patching: Patches AmsiScanBuffer in memory to interfere with antivirus scanning of scripts and payloads

If Mode3 fails to launch, the loader falls back to Mode2, which adds Microsoft Defender exclusions and uses a PowerShell script to decrypt and inject payloads into RegAsm.exe, a legitimate .NET assembly registration utility. This layered approach ensures the malware can adapt to different security configurations and still establish a foothold.

The Payloads: RAT, Clipper, and Stealer

Once the loader has established its foothold and neutralized local defenses, it deploys three distinct payloads, each serving a specific purpose in the attack chain:

AsyncRAT is a remote access trojan that provides attackers with full interactive control over the compromised machine. Dr. Web noted that it runs as two identical copies on different ports, likely allowing two separate operators to control a single device simultaneously. This dual-instance approach also provides redundancy, making the backdoor harder to fully eradicate.

Clipper malware monitors the system clipboard and replaces cryptocurrency wallet addresses with attacker-controlled addresses. When a user copies a wallet address to make a transaction, the malware silently swaps it, redirecting funds to the attacker without the victim’s knowledge until the transaction is confirmed on the blockchain.

Information stealer collects a broad range of sensitive data, including browser data, VPN settings, FTP client configuration files, gaming account credentials, and Discord tokens. All exfiltrated data is transmitted through a Telegram bot, a technique that abuses a popular messaging platform to blend malicious traffic with legitimate communications.

Antivirus Sabotage

In a particularly aggressive move, the malware actively attempts to remove ESET, McAfee, and Malwarebytes antivirus products from infected computers. It tries to disconnect these security tools from their update servers, preventing them from receiving the latest threat definitions that might detect the attack. This antisecurity capability demonstrates that the threat actor understands the typical security stack deployed on professional machines and has engineered the malware to dismantle it systematically.

The Broader Trend: Weaponizing Trust

This campaign is not an isolated incident. It reflects a broader shift documented in Elastic Security’s November 2026 quarterly threat report, which found that adversaries are increasingly abandoning traditional malware in favor of abusing legitimate, trusted software. In three confirmed intrusions documented by Elastic Threat Command, the payload was a signed, legitimate product rather than custom malware.

Remote monitoring and management software was the most commonly abused tool category, with ScreenConnect appearing most frequently across 23 confirmed RMM abuse findings. Attackers are leveraging the inherent trust placed in these tools to maintain persistent, interactive access on compromised endpoints. The GitHub fake tools campaign represents a natural evolution of this trend, targeting not just the tools themselves but the platforms where security professionals discover and download them.

Supply Chain Parallels

The GitHub campaign also mirrors the devastating supply chain attacks that have plagued the developer ecosystem throughout 2026. The Mini Shai-Hulud campaign, attributed to the TeamPCP threat actor group, simultaneously compromised packages across npm, PyPI, and RubyGems in April 2026, harvesting credentials from over 80 file paths including GitHub tokens, cloud API keys, and Kubernetes configurations. By August 2026, a variant of this malware had spread to over 400 npm packages through a self-propagating worm that used stolen credentials to republish itself.

The common thread is exploitation of trust. Whether it is a trusted package registry, a popular code repository, or a legitimate security tool, attackers are systematically identifying and weaponizing the mechanisms that developers and security professionals rely on every day.

Protecting Your Organization

Defending against this class of threat requires a fundamental shift in how organizations approach tool acquisition and code execution:

• Verify repository authenticity: Check contributor history, commit patterns, and community engagement before cloning or building any repository, especially security tools
• Sandbox untrusted code: Build and run unfamiliar repositories in isolated environments, never on production or developer workstations with access to sensitive credentials
• Scan for hidden code: Use tools that detect whitespace obfuscation in source files, and inspect Visual Studio pre-build and post-build event commands
• Monitor PowerShell activity: The infection chain relies heavily on PowerShell. Monitor for encoded commands, unusual download patterns, and script execution from unexpected locations
• Implement application allowlisting: Prevent unauthorized executables like Microsoft.exe from running by maintaining strict application control policies
• Rotate credentials regularly: Assume that any developer machine may be compromised and rotate API keys, tokens, and cloud credentials on a regular schedule
• Deploy behavior-based detection: Signature-based antivirus alone is insufficient. Invest in endpoint detection and response solutions that identify suspicious behavior patterns

The Road Ahead

As long as security professionals rely on open-source repositories to discover and deploy tools, threat actors will continue to weaponize that trust. The GitHub fake tools campaign demonstrates that attackers are now specifically targeting the defender community, exploiting the very curiosity and eagerness to experiment that makes security professionals effective at their jobs.

Organizations must recognize that the threat landscape has fundamentally shifted. The perimeter is no longer just the network edge. It is every repository, every package, every tool, and every script that a developer or security professional might pull from the internet. Vigilance, skepticism, and robust verification processes are no longer optional. They are the minimum standard for survival in an environment where the tools you trust can become the weapons used against you.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous