MicrosoftAvailable
SC-200
Fake GitHub Security Tools Push Backdoors and Infostealers
A campaign is hiding malware in fake GitHub security projects aimed at cybersecurity professionals. Dr. Web says more than 2,000 Windows systems are compromised. Here is how to check yourself and vet tools safely.
Short answer: Attackers are publishing fake security tools on GitHub that install the AsyncRAT backdoor, a clipboard clipper and an infostealer on Windows. Dr. Web reports more than 2,000 compromised systems. If you ran an unvetted repo recently, check Defender exclusions, project pre-build events and unexpected `Microsoft.exe` files, then rotate credentials from a clean device.
What the campaign does
Attackers are posting fake security tools on GitHub that install a backdoor and an information stealer on Windows PCs. BleepingComputer reported on November 6, 2026 that Dr. Web found more than 2,000 compromised systems.
The campaign started about two years ago. It first targeted crypto wallet users with lures such as blockchain games, bots and cheat tools. Recently the actor switched to repositories for automating scans, security testing and log analysis. One example is a fake script sold as a lightweight way to parse, clean and format output from the Fscan network scanner.
How the infection works
Dr. Web found malicious code in Visual Studio project files, Python scripts and Go source files. The code hides behind long stretches of whitespace. In some Visual Studio projects, a pre-build event routine runs it before compilation.
PowerShell then retrieves an encrypted download link. That link fetches a modular Electron-based loader named Microsoft.exe. The loader sets up persistence, elevates privileges, disables Windows security and recovery features, and injects the next stage into legitimate processes.
The final payloads are the AsyncRAT backdoor, clipper malware that swaps crypto wallet addresses in the clipboard, and an infostealer.
Who is at risk
Anyone who downloads and runs a GitHub security project without reviewing it. That includes analysts, pentesters, students and admins who grab a quick script for a scan or a log task. The reported compromises are Windows systems.
The infostealer collects browser data, VPN settings, FTP client configuration files, gaming account data and Discord tokens. It sends them out through a Telegram bot. A security professional's workstation often holds exactly these kinds of secrets, plus access to client networks.
How serious it is
This is actively exploited, and the scale is real: more than 2,000 compromised systems. The loader is built to fight your defenses.
Dr. Web describes six evasion techniques in the loader's default Mode3:
Technique | What it means for you |
|---|---|
Makes | Process trees look normal at a glance |
Changes a registry value to disable Smart App Control | A protection you expected may be off |
Restores original | Removes hooks placed by security software |
Makes direct Windows system calls | Harder for security tools to intercept |
Patches | Suppresses event tracing in the affected process |
Patches | Interferes with antivirus scanning of scripts |
If Mode3 fails to launch, the loader falls back to Mode2. That mode adds Microsoft Defender exclusions and injects payloads into RegAsm.exe using a PowerShell script. Dr. Web also found an unfinished component that could re-download the loader if it is removed, so the actor appears to be still developing it.
Check your machines now
Start with the repos you cloned recently. These commands search for the hiding tricks Dr. Web describes. Run them from a parent folder that holds your clones.
grep -rnP '[ \t]{80,}\S' --include=*.py --include=*.go --include=*.csproj --include=*.vcxproj .
grep -rn 'PreBuildEvent' --include=*.csproj --include=*.vcxproj --include=*.props --include=*.targets .The first command flags code that sits after a long run of whitespace. The second lists every pre-build event, so you can read what each one runs. A pre-build event that calls PowerShell is a red flag.
Next, check Windows for signs of the loader. Run these in PowerShell on any machine where you ran an unvetted project.
Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess, ExclusionExtension
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy' -Name VerifiedAndReputablePolicyState
Get-ChildItem C:\Users -Recurse -Filter Microsoft.exe -ErrorAction SilentlyContinue | Select-Object FullName, Length, CreationTime
Get-Process RegAsm -ErrorAction SilentlyContinue | Select-Object Id, StartTime, PathHow to read the results:
Defender exclusions you did not add point to the
Mode2fallback.Smart App Control state: Dr. Web does not name the exact registry value the loader changes.
VerifiedAndReputablePolicyStateis simply the usual place to check Smart App Control status, so it is not a confirmed indicator from the research. A value of0means the feature is off. Treat that as a clue only if you never turned it off yourself.A `Microsoft.exe` under a user folder is suspicious. Microsoft does not ship its tools that way.
A running `RegAsm.exe` you did not start deserves a closer look.
Then compare your logs with the indicators of compromise Dr. Web published (linked from BleepingComputer's report). Also search DNS or proxy logs for api.telegram.org traffic from hosts that have no reason to use Telegram.
If you find a hit
Treat the machine as fully compromised. The malware tampers with security tools and Windows backups, so cleaning it in place is hard to trust.
Disconnect the machine from the network.
From a different, clean device, change passwords and revoke sessions for browsers, VPNs, FTP clients, Discord and any crypto wallets.
Move any wallet funds to a new wallet created on a clean device.
Rebuild the system from known-good media instead of trusting a cleanup.
Tell your security team or clients if you held their access.
Vet a GitHub tool before you run it
Here is a worked example. You find a repo that promises to clean Fscan output.
Read every script end to end, then scroll right in each file to catch hidden code.
Run the two
grepchecks above on the folder.Open each
.csprojand look for pre-build events before you press Build.Run it first in a disposable VM with no saved logins and no shared clipboard.
Prefer well-known projects from maintainers you can verify, and read the code anyway.
If you spot something odd, use GitHub's report option on the repository.
What learners can take from this
This campaign shows that attackers target the people who defend networks. Habits like code review, sandboxing and checking logs for tampered defenses are core blue-team and pentest skills. If you want to practice detection and response, the CompTIA CySA+ CS0-003 voucher covers that work, and we email vouchers within 12 hours.
For more on attackers who exploit trust in tools and people, read our piece on fake job interviews and AI tool abuse and on trojanized CWP servers.
Sources
Questions about this topic
Does a virtual machine keep me safe when I test a GitHub tool?
A disposable VM keeps the malware away from your main system, which lowers the risk a lot. It only helps if the VM has no saved logins, no shared clipboard and no shared folders with your host. Snapshot it first and delete it after testing.
Can I trust a repository with many stars?
Not by itself. Stars and forks do not prove the code is safe, and a lure that looks useful can still hide a payload. Read the code and check the project files before you run anything.
Will my antivirus catch this malware?
Not reliably. Dr. Web says the malware tries to remove ESET, McAfee and Malwarebytes tools and tries to cut them off from their update servers. Layer your defenses and review code before running it instead of relying on one scanner.
Is this only a Windows problem?
The reported compromises are Windows systems, and the loader's evasion steps target Windows features such as Smart App Control, AMSI and event tracing. Still, check any tool you run on any platform. Hidden-whitespace tricks work in any source file.
What is a clipper and why does it matter?
A clipper watches your clipboard and swaps a copied crypto wallet address for one the attacker controls. You then send funds to the wrong place without noticing. Always compare the full address before you confirm a transfer.
