Researchers at Dr. Web found more than 2,000 Windows systems compromised by a campaign that hides malware inside GitHub repositories posing as security tools. The repositories advertise utilities for automating scans, security testing, and log analysis. Building or running them installs a backdoor and an information stealer on the user's machine. The activity described here was documented by BleepingComputer.

One example is a script billed as a lightweight way to parse, clean, and format output from the Fscan network scanner. The malicious code sits in Visual Studio project files, Python scripts, and Go source files, pushed out of view behind long stretches of whitespace. In some Visual Studio projects, a pre-build event runs the code before compilation starts.

The campaign has run for about two years. It began by targeting crypto wallet users with blockchain games, bots, and cheat tools, then shifted toward the people who defend networks: security researchers, penetration testers, and IT staff.

The payload chain includes:

• PowerShell stagers that retrieve an encrypted download link
• Microsoft.exe, a modular Electron-based loader that sets up persistence, raises its privileges, and injects later stages into legitimate processes
• AsyncRAT, a remote access backdoor that gives the operator ongoing control of the host
• Clipper malware that swaps crypto wallet addresses copied to the clipboard
• An information stealer that collects browser data, VPN settings, and FTP client configurations, then sends them out through a Telegram bot

The choice of victim is why this matters to your firm. Security and IT staff usually hold administrator rights, VPN access, and stored credentials for internal systems. If someone on your team builds one of these tools on a work laptop, the attacker gains that person's access along with the device.

For a managed service provider or consulting firm, that access often extends into client environments. Your analyst's saved browser sessions and VPN profiles can open the same doors for the operator, and activity through those accounts resembles routine administrative work. A single untrusted download on one workstation can therefore expose your own network and the networks of the clients your staff support.

How the Malicious Repositories Deliver AsyncRAT, Clippers, and the Microsoft.exe Loader

The campaign behind these repositories has run for about two years, and its lures have followed its targets. Dr. Web reports that earlier repositories posed as blockchain games, bots, and cheat tools aimed at crypto wallet users and gamers. The recent shift to security utilities puts the same malware in front of people whose job involves downloading and running unfamiliar code from GitHub.

This stage maps to T1195 (Supply Chain Compromise), since the victim pulls the malicious code in as if it were a normal third-party tool.

Execution depends on the developer doing what developers normally do. The whitespace padding that hides the code falls under T1027 (Obfuscated Files or Information). The Visual Studio pre-build event runs through MSBuild, which aligns with T1127.001 (Trusted Developer Utilities Proxy Execution). Compiling the project is enough to trigger the infection. Nobody has to launch a suspicious executable.

The hidden code then calls PowerShell (T1059.001) to retrieve an encrypted download link. That link fetches Microsoft.exe, a modular loader built on Electron, the framework that packages Chromium and Node.js into desktop applications. The filename is a clear case of T1036 (Masquerading). A process carrying the vendor's name looks routine in a task list, and that makes manual triage on the affected machine harder.

The loader sets up persistence, elevates its privileges, disables Windows security and recovery features, and injects the next stage into legitimate processes (T1055, Process Injection). In its default Mode3, Dr. Web documented six evasion techniques:

• Spoofing explorer.exe as its parent process (T1134.004, Parent PID Spoofing)
• Changing a registry value to turn off Smart App Control (T1112, T1562.001)
• Restoring original ntdll.dll code from disk to strip hooks placed by security software
• Making direct Windows system calls that endpoint tools struggle to intercept (T1106)
• Patching EtwEventWrite in memory to suppress event tracing (T1562.006)
• Patching AmsiScanBuffer in memory to interfere with script scanning

If Mode3 fails, the loader falls back to Mode2. It adds Microsoft Defender exclusions and uses a PowerShell script to decrypt the payloads and inject them into RegAsm.exe, a signed .NET utility. Because the malware runs inside processes Windows already trusts, your endpoint logs show legitimate binary names during the period the attacker is most active.

Three payloads land on the host:

• AsyncRAT, a backdoor giving the operator ongoing remote control (T1219), backed by the loader's persistence
• Clipper malware that watches the clipboard and swaps copied cryptocurrency wallet addresses for the attacker's own (T1115)
• An information stealer that collects browser data, VPN settings, FTP client configuration files, gaming account data, and Discord tokens, then sends them out through a Telegram bot (T1567, Exfiltration Over Web Service)

The stolen VPN settings and browser data give an attacker what they need to reach corporate systems as the victim. Any cryptocurrency transfer made from an infected machine can be redirected without the sender noticing the altered address.

The malware also attempts to uninstall ESET, McAfee, and Malwarebytes, cut those products off from their update servers, and interfere with Windows backups, which corresponds to T1490 (Inhibit System Recovery). Dr. Web also found an unfinished component meant to keep the loader running and download it again if it is deleted from disk, which indicates continued development. The researchers published a complete indicator list for the campaign. The confirmed host artifacts named in the reporting are the Microsoft.exe loader, injection into RegAsm.exe, and exfiltration through Telegram.

What a Compromised Analyst Workstation Exposes

The infostealer in this campaign collects browser data, VPN settings, FTP client configuration files, gaming account data, and Discord tokens, then sends them to the operator through a Telegram bot. On an analyst's machine, those categories overlap with the access your security team uses every day. VPN settings show the attacker where your remote access lives and how it is configured. Saved browser data often includes logins and active sessions for admin consoles and cloud portals.

AsyncRAT widens the exposure beyond what the stealer grabs automatically. As a remote access trojan, it lets the operator browse files, run commands, and observe activity on the infected host. Anything stored on your tester's disk becomes reachable, including SSH private keys, cloud CLI credentials, scan output, draft vulnerability reports, and internal scripts your team built for its own work. A list of unpatched findings tells an attacker exactly which systems in a client network are open to known exploits.

The malware also reduces your ability to see and undo the compromise. Dr. Web found that it attempts to remove ESET, McAfee, and Malwarebytes, disconnect those products from their update servers, and interfere with Windows backups. Stolen data can leave the machine while the endpoint appears quiet, and restoring the workstation to a known good state takes longer. Researchers also found an unfinished component built to keep the loader running and download it again if deleted, which suggests longer persistence in future versions.

For MSSPs and consultancies, the exposure extends across clients. A single penetration tester or SOC analyst often holds VPN profiles, jump host credentials, and engagement files for several organizations at once. If that person builds one of these fake tools, the attacker gains a path into each of those environments using credentials the clients already trust. Activity from those accounts resembles normal engagement work, so a client's own monitoring may not flag it.

The clipper component causes direct financial loss with no further intrusion required. It watches the clipboard and swaps any copied cryptocurrency wallet address for one the attacker controls. If you or your staff send crypto payments from an infected machine, the funds go to the attacker, and blockchain transfers generally cannot be reversed. Firms that use cryptocurrency for bug bounty payouts, ransom negotiation support, or treasury operations carry this risk on every transaction made from that host.

Access to client data also carries legal and contractual weight. If an attacker reaches engagement files containing personal data, credentials, or system details for your clients, you may face breach-notification duties under the privacy laws that apply to that data. Many service agreements and NDAs require you to tell clients when their information is exposed, and some include indemnity clauses or termination rights. Your cyber insurance carrier will also want to know how the tool entered your environment and what was stored on the workstation at the time.

The total cost of one infected analyst workstation therefore goes well beyond rebuilding a laptop. Your firm may have to rotate every credential the affected user held, notify each client whose environment that user accessed, and review all engagement work performed while the machine was compromised.

Detecting AsyncRAT and Electron Loader Activity on Endpoints

Start by pulling the full indicator list Dr. Web published for this campaign and sweeping your endpoints for those hashes, domains, and file names. Then hunt for the loader directly. Search every workstation for files named Microsoft.exe and flag any copy that lives outside C:\Windows\System32 or C:\Program Files, lacks a valid Microsoft signature, or sits next to Electron runtime files such as resources\app.asar. A Microsoft-branded executable running from a user profile, Downloads, or temp folder is an anomaly on any analyst machine.

Next, look at process lineage. Alert when an Electron-based process launches powershell.exe. The loader also makes explorer.exe appear to be its parent, so a parent-child rule alone will miss some executions. Pair it with a time-based rule: PowerShell started from explorer.exe within a minute or two of an unsigned Microsoft.exe running on the same host.

For command lines, a simple Sigma-style condition covers most of the delivery stage. Match powershell.exe where the command line contains -enc or -EncodedCommand, combined with -w hidden, IEX, or DownloadString. Enable PowerShell script block logging so you capture the decoded content. Keep in mind the loader patches AmsiScanBuffer and EtwEventWrite in memory, so a host that suddenly stops sending script or event telemetry is itself a finding worth investigating.

Defense tampering leaves clear traces you can query:

• New Microsoft Defender exclusions, including Add-MpPreference -ExclusionPath or -ExclusionProcess in PowerShell logs
• Registry changes that turn off Smart App Control
• Uninstall events or service stops for ESET, McAfee, or Malwarebytes, and those agents failing to check in with their update servers
• Changes to Windows backup or recovery settings that no administrator requested
• RegAsm.exe running without a .NET registration task behind it, or making outbound network connections, which points to the Mode2 injection path

For persistence, correlate new Run key entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Run and new scheduled tasks with recent git activity. A persistence change created shortly after a git clone, a Python script run, or a Visual Studio build is the pattern this campaign produces. Each confirmed match means the workstation's stored credentials and sessions need to be revoked, so early correlation shortens the cleanup.

On the network side, watch for AsyncRAT beaconing: regular, long-lived outbound connections from RegAsm.exe or explorer-spawned processes to rarely seen IP addresses on non-standard ports. Separately, flag connections to api.telegram.org from any process other than an installed Telegram client, since the stealer exfiltrates through a Telegram bot. If your EDR records API calls, look for background processes with no window that repeatedly read the clipboard through calls like GetClipboardData or register a clipboard listener. That behavior matches the clipper component.

Finally, review what your team has actually pulled from GitHub. On each analyst workstation, list folders containing a .git directory, read the remote URL in each .git\config, and check Downloads for recently extracted repository archives. Review %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt for clone and run commands. In any Visual Studio project you find, open the .csproj or .vcxproj file and inspect PreBuildEvent entries, scrolling horizontally past long whitespace runs where the malicious commands sit. Isolate any host where a cloned tool matches these findings before you start credential resets.

Response Steps and Safe Handling of Untrusted GitHub Code

If you suspect that an analyst built or ran one of these repositories, disconnect the workstation from the network first and leave it powered on so memory can be captured. The loader injects its payloads into legitimate processes, so the clearest evidence of the running implant may exist only in memory. Isolation also ends the operator's remote session before more data leaves the machine.

Plan to reimage the host from known-good media. Dr. Web found that this malware disables Windows security and recovery features, tries to uninstall ESET, McAfee, and Malwarebytes, and cuts those tools off from their update servers. The researchers also found an unfinished component built to download the loader again if it is deleted. A machine in that state cannot reliably report its own health, and a cleanup that misses one piece leaves the attacker with continued access.

The next priority is rotating every credential, key, and token used on that machine. Do this from a separate, clean device. Reset VPN passwords and reissue VPN certificates. Change saved browser passwords and revoke active sessions for cloud and admin portals. Replace API keys, SSH keys, and FTP account passwords, and revoke Discord tokens. Start with the accounts that reach client or production systems, because those carry the largest consequence if reused.

Two more checks belong in the first day:

• Review recent cryptocurrency transactions sent from the affected machine. Compare each destination address against the address the recipient actually provided, since the clipper swaps copied wallet addresses for the attacker's own.
• Notify clients if the workstation held engagement data or connected to client environments. They need to rotate any credentials your team held and review their own logs for access from unfamiliar sources. Check your contracts for notification deadlines.

Because the malware interferes with Windows backups, confirm that any backup you plan to restore is intact and predates the download. Restore documents and data files only. Do not restore executables or project folders from the infection window.

In the following weeks, set a rule that unvetted proof-of-concept code and tools run only in disposable VMs or sandboxes. Those environments should hold no saved credentials, have no network path to production or client systems, and revert to a clean snapshot after each use. This lets analysts test what they find while keeping a malicious build away from the accounts that matter.

Before anyone compiles or runs a downloaded tool, have them read the code and build scripts. Check the pre-build event section of Visual Studio project files, turn on visible whitespace or word wrap so code hidden far to the right shows up, and search for PowerShell calls or long encoded strings. Look at the repository itself as well. A new repository with a single contributor, very little commit history, and a sudden spike in stars deserves extra scrutiny before anyone runs it.

Over the longer term, keep an internal allowlist or mirror of vetted tools, pinned to specific commits your team has reviewed. Analysts then pull scanners and parsers from that copy, and updates go through the same review before they are added.

Enforce application control on analyst workstations so unsigned binaries cannot run. Push the policy centrally and alert when it changes, since this loader edits a registry value to switch off Smart App Control and adds Microsoft Defender exclusions when it runs in its fallback mode. A locally changed security setting on an analyst machine should open a ticket.

Finally, train your staff that GitHub is a hosting platform and confers no trust on its own. Include a real example from this campaign, such as the Fscan output parser, in your next security awareness session and walk through the review checklist above.

Treat Every Public PoC as Untrusted Until Proven Otherwise

This campaign works because security professionals clone and run code from GitHub as a routine part of their jobs. The operator spent about two years refining the approach with crypto and gaming lures, then moved to scanners and log parsers while keeping the same payload set of AsyncRAT, a clipper, and a staged loader. Dr. Web also found a seemingly unfinished component designed to keep the loader running and download it again if it is deleted from disk, which indicates the operator is still adding features.

The pattern extends beyond this one actor. Recent reports describe fake LastPass Authenticator repositories pushing the Rapuncel infostealer, and backdoored OVHcloud CLI releases on GitHub built to steal developer secrets. For your team, a familiar tool name, a polished README, or an active commit history tells you little about what a repository will do once you build it. Treat any public proof of concept or helper script you pull in with the same suspicion you would give an attachment from an unknown sender.

The most important habit is straightforward. Never build or run an unreviewed GitHub tool on a workstation that holds your credentials, VPN access, or client environments. Run it only in an isolated, disposable virtual machine that you can delete afterward, with no saved logins and no network path into your production or client systems. If you are unsure whether your analysts' daily workflow keeps untrusted code away from privileged machines, a security assessment focused on how your team sources and executes third-party tools can show where that separation is missing.