--- title: Fake security tools on GitHub push backdoors and infostealers Attack Chain, Detection, and - Capstone Technologies Group description: Fake GitHub security tools hit 2,000+ Windows systems with AsyncRAT and an infostealer. Covers the attack chain and how to detect the Microsoft.exe loader. canonical_url: https://captechgroup.com/threat-intelligence-center/fake-security-tools-on-github-push-backdoors-and-i-c204bd language: en-GB date: 2026-11-07T12:35:54Z notice: This is a machine-friendly version of the page at https://captechgroup.com/threat-intelligence-center/fake-security-tools-on-github-push-backdoors-and-i-c204bd. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 5871 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/threat-intelligence-center/fake-security-tools-on-github-push-backdoors-and-i-c204bd. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. Researchers at **Dr. Web** found more than 2,000 Windows systems compromised by a campaign that hides malware inside GitHub repositories posing as security tools. The repositories advertise utilities for automating scans, security testing, and log analysis. Building or running them installs a backdoor and an information stealer on the user's machine. The activity described here was documented by [BleepingComputer](https://www.bleepingcomputer.com/news/security/fake-security-tools-on-github-push-backdoors-and-infostealers/ "Source: BleepingComputer"). One example is a script billed as a lightweight way to parse, clean, and format output from the **Fscan** network scanner. The malicious code sits in Visual Studio project files, Python scripts, and Go source files, pushed out of view behind long stretches of whitespace. In some Visual Studio projects, a pre-build event runs the code before compilation starts. The campaign has run for about two years. It began by targeting crypto wallet users with blockchain games, bots, and cheat tools, then shifted toward the people who defend networks: security researchers, penetration testers, and IT staff. The payload chain includes: - **[PowerShell](https://attack.mitre.org/techniques/T1059/ "MITRE ATT&CK: T1059") stagers** that retrieve an encrypted download link - **Microsoft.exe**, a modular Electron-based loader that sets up persistence, raises its privileges, and injects later stages into legitimate processes - **AsyncRAT**, a remote access backdoor that gives the operator ongoing control of the host - **Clipper malware** that swaps crypto wallet addresses copied to the clipboard - An **information stealer** that collects browser data, VPN settings, and FTP client configurations, then sends them out through a Telegram bot The choice of victim is why this matters to your firm. Security and IT staff usually hold administrator rights, VPN access, and stored credentials for internal systems. If someone on your team builds one of these tools on a work laptop, the attacker gains that person's access along with the device. For a managed service provider or consulting firm, that access often extends into client environments. Your analyst's saved browser sessions and VPN profiles can open the same doors for the operator, and activity through those accounts resembles routine administrative work. A single untrusted download on one workstation can therefore expose your own network and the networks of the clients your staff support. ## How the Malicious Repositories Deliver AsyncRAT, Clippers, and the Microsoft.exe Loader The campaign behind these repositories has run for about two years, and its lures have followed its targets. Dr. Web reports that earlier repositories posed as **blockchain games, bots, and cheat tools** aimed at crypto wallet users and gamers. The recent shift to security utilities puts the same malware in front of people whose job involves downloading and running unfamiliar code from GitHub. This stage maps to **T1195 (Supply Chain Compromise)**, since the victim pulls the malicious code in as if it were a normal third-party tool. **Key Insight:** A security analyst's workstation often holds VPN profiles, saved credentials, and administrative access, so one compromised laptop can expose far more than the person using it. Execution depends on the developer doing what developers normally do. The whitespace padding that hides the code falls under **T1027 (Obfuscated Files or Information)**. The Visual Studio pre-build event runs through MSBuild, which aligns with **T1127.001 (Trusted Developer Utilities Proxy Execution)**. Compiling the project is enough to trigger the infection. Nobody has to launch a suspicious executable. The hidden code then calls **PowerShell (T1059.001)** to retrieve an encrypted download link. That link fetches **Microsoft.exe**, a modular loader built on Electron, the framework that packages Chromium and Node.js into desktop applications. The filename is a clear case of **T1036 (Masquerading)**. A process carrying the vendor's name looks routine in a task list, and that makes manual triage on the affected machine harder. The loader sets up persistence, elevates its privileges, disables Windows security and recovery features, and injects the next stage into legitimate processes (**T1055, Process Injection**). In its default **Mode3**, Dr. Web documented six evasion techniques: - Spoofing `explorer.exe` as its parent process (T1134.004, Parent PID Spoofing) - Changing a registry value to turn off **Smart App Control** (T1112, T1562.001) - Restoring original `ntdll.dll` code from disk to strip hooks placed by security software - Making direct Windows system calls that endpoint tools struggle to intercept (T1106) - Patching `EtwEventWrite` in memory to suppress event tracing (T1562.006) - Patching `AmsiScanBuffer` in memory to interfere with script scanning If Mode3 fails, the loader falls back to **Mode2**. It adds Microsoft Defender exclusions and uses a PowerShell script to decrypt the payloads and inject them into `RegAsm.exe`, a signed .NET utility. Because the malware runs inside processes Windows already trusts, your endpoint logs show legitimate binary names during the period the attacker is most active. Three payloads land on the host: - **AsyncRAT**, a backdoor giving the operator ongoing remote control (T1219), backed by the loader's persistence - **Clipper malware** that watches the clipboard and swaps copied cryptocurrency wallet addresses for the attacker's own (T1115) - An **information stealer** that collects browser data, VPN settings, FTP client configuration files, gaming account data, and Discord tokens, then sends them out through a Telegram bot (T1567, Exfiltration Over Web Service) The stolen VPN settings and browser data give an attacker what they need to reach corporate systems as the victim. Any cryptocurrency transfer made from an infected machine can be redirected without the sender noticing the altered address. The malware also attempts to uninstall **ESET, McAfee, and Malwarebytes**, cut those products off from their update servers, and interfere with Windows backups, which corresponds to **T1490 (Inhibit System Recovery)**. Dr. Web also found an unfinished component meant to keep the loader running and download it again if it is deleted from disk, which indicates continued development. The researchers published a complete indicator list for the campaign. The confirmed host artifacts named in the reporting are the `Microsoft.exe` loader, injection into `RegAsm.exe`, and exfiltration through Telegram. ## What a Compromised Analyst Workstation Exposes The infostealer in this campaign collects browser data, VPN settings, FTP client configuration files, gaming account data, and Discord tokens, then sends them to the operator through a **Telegram bot**. On an analyst's machine, those categories overlap with the access your security team uses every day. VPN settings show the attacker where your remote access lives and how it is configured. Saved browser data often includes logins and active sessions for admin consoles and cloud portals. **AsyncRAT** widens the exposure beyond what the stealer grabs automatically. As a remote access trojan, it lets the operator browse files, run commands, and observe activity on the infected host. Anything stored on your tester's disk becomes reachable, including SSH private keys, cloud CLI credentials, scan output, draft vulnerability reports, and internal scripts your team built for its own work. A list of unpatched findings tells an attacker exactly which systems in a client network are open to known exploits. The malware also reduces your ability to see and undo the compromise. Dr. Web found that it attempts to remove ESET, McAfee, and Malwarebytes, disconnect those products from their update servers, and interfere with Windows backups. Stolen data can leave the machine while the endpoint appears quiet, and restoring the workstation to a known good state takes longer. Researchers also found an unfinished component built to keep the loader running and download it again if deleted, which suggests longer persistence in future versions. For MSSPs and consultancies, the exposure extends across clients. A single penetration tester or SOC analyst often holds VPN profiles, jump host credentials, and engagement files for several organizations at once. If that person builds one of these fake tools, the attacker gains a path into each of those environments using credentials the clients already trust. Activity from those accounts resembles normal engagement work, so a client's own monitoring may not flag it. The **clipper** component causes direct financial loss with no further intrusion required. It watches the clipboard and swaps any copied cryptocurrency wallet address for one the attacker controls. If you or your staff send crypto payments from an infected machine, the funds go to the attacker, and blockchain transfers generally cannot be reversed. Firms that use cryptocurrency for bug bounty payouts, ransom negotiation support, or treasury operations carry this risk on every transaction made from that host. Access to client data also carries legal and contractual weight. If an attacker reaches engagement files containing personal data, credentials, or system details for your clients, you may face breach-notification duties under the privacy laws that apply to that data. Many service agreements and NDAs require you to tell clients when their information is exposed, and some include indemnity clauses or termination rights. Your cyber insurance carrier will also want to know how the tool entered your environment and what was stored on the workstation at the time. The total cost of one infected analyst workstation therefore goes well beyond rebuilding a laptop. Your firm may have to rotate every credential the affected user held, notify each client whose environment that user accessed, and review all engagement work performed while the machine was compromised. ## Detecting AsyncRAT and Electron Loader Activity on Endpoints Start by pulling the full indicator list Dr. Web published for this campaign and sweeping your endpoints for those hashes, domains, and file names. Then hunt for the loader directly. Search every workstation for files named `Microsoft.exe` and flag any copy that lives outside `C:\Windows\System32` or `C:\Program Files`, lacks a valid Microsoft signature, or sits next to Electron runtime files such as `resources\app.asar`. A Microsoft-branded executable running from a user profile, Downloads, or temp folder is an anomaly on any analyst machine. Next, look at process lineage. Alert when an Electron-based process launches `powershell.exe`. The loader also makes **explorer.exe** appear to be its parent, so a parent-child rule alone will miss some executions. Pair it with a time-based rule: PowerShell started from explorer.exe within a minute or two of an unsigned `Microsoft.exe` running on the same host. For command lines, a simple Sigma-style condition covers most of the delivery stage. Match `powershell.exe` where the command line contains `-enc` or `-EncodedCommand`, combined with `-w hidden`, `IEX`, or `DownloadString`. Enable PowerShell script block logging so you capture the decoded content. Keep in mind the loader patches **AmsiScanBuffer** and **EtwEventWrite** in memory, so a host that suddenly stops sending script or event telemetry is itself a finding worth investigating. Defense tampering leaves clear traces you can query: - New Microsoft Defender exclusions, including `Add-MpPreference -ExclusionPath` or `-ExclusionProcess` in PowerShell logs - Registry changes that turn off Smart App Control - Uninstall events or service stops for ESET, McAfee, or Malwarebytes, and those agents failing to check in with their update servers - Changes to Windows backup or recovery settings that no administrator requested - **RegAsm.exe** running without a .NET registration task behind it, or making outbound network connections, which points to the Mode2 injection path For persistence, correlate new Run key entries under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and new scheduled tasks with recent git activity. A persistence change created shortly after a `git clone`, a Python script run, or a Visual Studio build is the pattern this campaign produces. Each confirmed match means the workstation's stored credentials and sessions need to be revoked, so early correlation shortens the cleanup. On the network side, watch for **AsyncRAT** beaconing: regular, long-lived outbound connections from RegAsm.exe or explorer-spawned processes to rarely seen IP addresses on non-standard ports. Separately, flag connections to `api.telegram.org` from any process other than an installed Telegram client, since the stealer exfiltrates through a Telegram bot. If your [EDR](https://captechgroup.com/services/cybersecurity-services) records API calls, look for background processes with no window that repeatedly read the clipboard through calls like `GetClipboardData` or register a clipboard listener. That behavior matches the clipper component. Finally, review what your team has actually pulled from GitHub. On each analyst workstation, list folders containing a `.git` directory, read the remote URL in each `.git\config`, and check Downloads for recently extracted repository archives. Review `%APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt` for clone and run commands. In any Visual Studio project you find, open the `.csproj` or `.vcxproj` file and inspect `PreBuildEvent` entries, scrolling horizontally past long whitespace runs where the malicious commands sit. Isolate any host where a cloned tool matches these findings before you start credential resets. ## Response Steps and Safe Handling of Untrusted GitHub Code If you suspect that an analyst built or ran one of these repositories, **disconnect the workstation from the network first** and leave it powered on so memory can be captured. The loader injects its payloads into legitimate processes, so the clearest evidence of the running implant may exist only in memory. Isolation also ends the operator's remote session before more data leaves the machine. Plan to **reimage the host from known-good media**. Dr. Web found that this malware disables Windows security and recovery features, tries to uninstall ESET, McAfee, and Malwarebytes, and cuts those tools off from their update servers. The researchers also found an unfinished component built to download the loader again if it is deleted. A machine in that state cannot reliably report its own health, and a cleanup that misses one piece leaves the attacker with continued access. The next priority is **rotating every credential, key, and token used on that machine**. Do this from a separate, clean device. Reset VPN passwords and reissue VPN certificates. Change saved browser passwords and revoke active sessions for cloud and admin portals. Replace API keys, SSH keys, and FTP account passwords, and revoke Discord tokens. Start with the accounts that reach client or production systems, because those carry the largest consequence if reused. Two more checks belong in the first day: - **Review recent cryptocurrency transactions** sent from the affected machine. Compare each destination address against the address the recipient actually provided, since the clipper swaps copied wallet addresses for the attacker's own. - **Notify clients** if the workstation held engagement data or connected to client environments. They need to rotate any credentials your team held and review their own logs for access from unfamiliar sources. Check your contracts for notification deadlines. Because the malware interferes with Windows backups, confirm that any backup you plan to restore is intact and predates the download. Restore documents and data files only. Do not restore executables or project folders from the infection window. In the following weeks, set a rule that **unvetted proof-of-concept code and tools run only in disposable VMs or sandboxes**. Those environments should hold no saved credentials, have no network path to production or client systems, and revert to a clean snapshot after each use. This lets analysts test what they find while keeping a malicious build away from the accounts that matter. Before anyone compiles or runs a downloaded tool, have them read the code and build scripts. Check the pre-build event section of Visual Studio project files, turn on visible whitespace or word wrap so code hidden far to the right shows up, and search for PowerShell calls or long encoded strings. Look at the repository itself as well. A new repository with a single contributor, very little commit history, and a sudden spike in stars deserves extra scrutiny before anyone runs it. Over the longer term, keep an **internal allowlist or mirror of vetted tools**, pinned to specific commits your team has reviewed. Analysts then pull scanners and parsers from that copy, and updates go through the same review before they are added. Enforce **application control on analyst workstations** so unsigned binaries cannot run. Push the policy centrally and alert when it changes, since this loader edits a registry value to switch off Smart App Control and adds Microsoft Defender exclusions when it runs in its fallback mode. A locally changed security setting on an analyst machine should open a ticket. Finally, train your staff that GitHub is a hosting platform and confers no trust on its own. Include a real example from this campaign, such as the Fscan output parser, in your next security awareness session and walk through the review checklist above. Responding to a compromised analyst workstation 1 Disconnect it from the network and leave it powered on so memory can be captured. This ends the operator's remote session, and the injected implant may only be visible in memory. 2 The malware disables Windows security and recovery features and tries to remove ESET, McAfee, and Malwarebytes. A cleanup cannot be trusted, so rebuild the host. 3 Reissue VPN certificates and replace API keys, SSH keys, and FTP passwords. Revoke browser sessions and Discord tokens, starting with accounts that reach client or production systems. 4 Compare cryptocurrency destination addresses against those the recipients provided, because the clipper swaps copied wallet addresses. Notify clients whose data or environments the workstation touched. 5 Confirm that backups are intact and predate the download, then restore documents and data files only. Afterward, run unvetted proof-of-concept code only in disposable VMs or sandboxes. ## Treat Every Public PoC as Untrusted Until Proven Otherwise This campaign works because security professionals clone and run code from GitHub as a routine part of their jobs. The operator spent about two years refining the approach with crypto and gaming lures, then moved to scanners and log parsers while keeping the same payload set of **AsyncRAT**, a **clipper**, and a staged loader. Dr. Web also found a seemingly unfinished component designed to keep the loader running and download it again if it is deleted from disk, which indicates the operator is still adding features. The pattern extends beyond this one actor. Recent reports describe fake LastPass Authenticator repositories pushing the **Rapuncel** infostealer, and backdoored OVHcloud CLI releases on GitHub built to steal developer secrets. For your team, a familiar tool name, a polished README, or an active commit history tells you little about what a repository will do once you build it. Treat any public proof of concept or helper script you pull in with the same suspicion you would give an attachment from an unknown sender. The most important habit is straightforward. **Never build or run an unreviewed GitHub tool on a workstation that holds your credentials, VPN access, or client environments.** Run it only in an isolated, disposable virtual machine that you can delete afterward, with no saved logins and no network path into your production or client systems. If you are unsure whether your analysts' daily workflow keeps untrusted code away from privileged machines, a [security assessment](https://captechgroup.com/security-assessment) focused on how your team sources and executes third-party tools can show where that separation is missing. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-11-07T12:35:54Z", "datePublished": "2026-11-07T12:35:54Z", "description": "Fake GitHub security tools hit 2,000+ Windows systems with AsyncRAT and an infostealer. Covers the attack chain and how to detect the Microsoft.exe loader.", "headline": "Fake security tools on GitHub push backdoors and infostealers Attack Chain, Detection, and", "image": [ { "@type": "ImageObject", "url": "https:\/\/images.captechgroup.com\/cdn-cgi\/image\/width=1200,format=webp,quality=85\/threat-intel\/e24201cf93.jpg", "caption": "", "description": "Fake GitHub security tool repo compromising an analyst workstation and spreading via VPN into client networks", "width": 1200, "height": 685 } ], "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/fake-security-tools-on-github-push-backdoors-and-i-c204bd" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/fake-security-tools-on-github-push-backdoors-and-i-c204bd" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "", "streetAddress": "", "addressCountry": "US" } ] } ```