Fake GitHub security tools infect more than 2,000 PCs

Doctor Web found malware in GitHub projects posing as security tools, with more than 2,000 PCs infected at the time of its investigation. The campaign began about two years ago with Visual Studio projects for blockchain games, bots and cheats, aimed at people using crypto wallets. It has since expanded to target information security professionals with purported tools for scanning, security testing and log analysis, including a fake utility for processing Fscan results.

The projects conceal malicious commands in build files and configuration settings, as well as in Python and Go code obscured by blocks of blank space. Opening a project runs a PowerShell script that retrieves an encrypted link to an archive. This installs Microsoft.exe, an Electron-based programme that gathers system information and sends it to a Telegram bot, raises its privileges and disables Windows Defender, User Account Control, System Restore and shadow copies. Doctor Web also found it can remove McAfee, ESET and Malwarebytes, evade security monitoring and inject code into legitimate processes.

The malware deploys AsyncRAT, a clipboard clipper that substitutes cryptocurrency wallet addresses, and a data stealer. Stolen information can include browser data, VPN settings, messenger files, game accounts and Discord tokens; the files are packaged and sent through Telegram. The malware also changes the Windows hosts file to block antivirus vendors’ domains.

Doctor Web says the attackers are continuing development and found an unfinished component that could reinstall Microsoft.exe if it is deleted, manage startup and install updates. The researchers advise keeping antivirus software up to date and scanning downloaded files.