GitHub & Dropbox Weaponized: “Defendnot” Tool Used to Disable Windows Defender

A FortiGuard Labs briefing has detailed a sophisticated multi-stage malware campaign that targets users in Russia, abusing legitimate cloud services and Windows research tooling to bypass standard protections. The attackers repurpose Defendnot, a tool created by security researchers to demonstrate weaknesses in Windows Defender, to disable Microsoft Defender before heavier payloads arrive.

GitHub is used to distribute the scripts that orchestrate the attack, while Dropbox hosts the larger binary payloads, creating a modular hosting approach that can resemble legitimate enterprise activity. The operation culminates with the deployment of Amnesia RAT to achieve long-term control, reconnaissance and credential theft, followed by subsequent ransomware and WinLocker components aimed at data denial and pressure.

Victims receive social engineering via business-themed documents, with decoy tasks and status messages masking the malicious activity running in the background. Organisations are urged to monitor for anomalous security configuration changes and unusual traffic to cloud storage services, as early detection is critical to stopping the infection. January 22, 2026. according to FortiGuard Labs.