Skip to content
Hacker Posts

Fake GitHub security tools drop AsyncRAT and a stealer at researchers

Dr.Web says a two-year GitHub campaign now baits security pros with bogus scanner and log-analysis tools, dropping AsyncRAT, a clipper and a stealer via an Electron loader. 2,000+ Windows hosts hit.

Published 3 min read
threat-intelsupply-chaingithubasyncrat

A GitHub campaign that ran for roughly two years against crypto users has pivoted to targeting information-security professionals with repositories posing as security tooling, according to a Dr.Web report published 5 November 2026. The malicious projects advertise scan automation, security-system testing and log analysis — one is a fake script to parse and format output from the Fscan network scanner. Dr.Web counts more than 2,000 compromised Windows systems, and BleepingComputer reported the shift the following day.

How the lure works

The payload is not in an obvious script. Dr.Web found malicious code hidden behind long stretches of whitespace in .go and .py source files, in .suo files, and — most effective against developers who build before they read — in a PreBuildEvent inside .csproj project files that runs the moment the target compiles the project in Visual Studio. The chain then launches PowerShell, retrieves an encrypted string, and downloads a Quixo.7z archive.

What gets dropped

Dr.Web tracks the components by family:

  • Loader: Trojan.Loader.3261 — a modular, Electron-based program distributed as Microsoft.exe (v1.4.5 at analysis), using supporting scripts PowerShell.Packed.270 and PowerShell.Inject.245.
  • Backdoor: BackDoor.AsyncRAT.115 — two identical copies configured on different ports.
  • Injector: Trojan.InjectNET.14.
  • Clipper: Trojan.Clipper.688, which swaps cryptocurrency wallet addresses in the clipboard.
  • Stealer: JS.Stealer.191, which collects browser data, FTP and VPN settings, messenger files, and game and Discord credentials.

The loader also attempts to remove ESET, McAfee and Malwarebytes, adds Microsoft Defender exclusions in a fallback mode, and interferes with Windows backups.

Detection

Dr.Web published indicators in its DoctorWebLtd/malware-iocs repository, which also lists SHA-1 file hashes. The network indicators, verbatim and defanged as the source wrote them:

muckanthropic[.]com
muckduck.duckdns[.]org
muckcoding[.]com
muckdeveloper[.]com
130[.]12.182[.]172
130[.]12.182[.]209

Action checklist

  1. Block the C2 domains and IPs above at the egress proxy and DNS; alert on any hit from a developer workstation.
  2. Audit cloned repositories for a PreBuildEvent in .csproj files and for lines of source padded with large whitespace runs in .go, .py and .suo files before you build or run anything.
  3. Treat a prompt to compile an unfamiliar project as code execution. Review it in an editor first; build in a throwaway VM, not your daily driver.
  4. Hunt for Microsoft.exe, Quixo.7z, and newly added Defender exclusions on engineering hosts.
  5. Rotate any crypto-wallet, Discord, VPN or FTP credentials that touched a machine where an untrusted repo was built.

Context

Security researchers are a recurring target for poisoned-repository campaigns — the audience most likely to clone and run unfamiliar offensive tooling. It is the same trust abuse Sekoia described when it tied a "Poisoned Source" watering hole to APT29 via the Plerdy supply chain last week, and that surfaced again when Gheist abused stolen GitHub tokens to leak CI secrets. Dr.Web does not attribute the activity to a named group, and no group has claimed it; the two-year runway and the pivot from crypto victims to defenders point to a financially motivated operator broadening its target set, not a state actor.

Related stories