Fake security tools on GitHub: 2,000 Windows machines backdoored
A two-year-old campaign that once chased cryptocurrency wallet owners has turned its attention to the people who investigate malware. According to research published by Doctor Web (Dr.Web) on 5 November, more than 2,000 Windows systems have been compromised through malicious GitHub repositories that present themselves as security tooling. The lures are not crude: they include a parser, cleaner and formatter for output from the Fscan network scanner, repositories for scan automation and security testing, and utilities for processing logs.
A lure aimed at people who should know better
The shift in targeting is the notable part. Dr.Web says the first infected repositories appeared roughly two years ago and were built around blockchain games, bots and cheat tools, with malicious code hidden in Visual Studio project files. The current wave keeps the same delivery mechanics but changes the packaging to something an analyst would plausibly clone during a working day. The repositories even include instructions for installing Visual Studio and cloning the project, which lowers the barrier for less experienced users. BleepingComputer's write-up notes that the operation has been running for about two years.Where the code hides
The malicious logic is not in the part of the repository a reviewer would normally read. In .csproj files it sits in a PreBuildEvent routine that runs before the project compiles. In .suo files, which most people treat as disposable editor state, it arrives as a PowerShell command. In Go and Python sources, one sample is named FscanOutput_v2.2.py, the code is pushed behind long runs of whitespace, an old trick that Dr.Web notes still works. That first stage, tracked as PowerShell.Packed.270, is written to paths such as C:\Users\Public\Pictures\t.ps1 and decrypts a download link for an archive called Quixo.7z, which unpacks into C:\ProgramData\Windows.Microsoft.Photos.Microsoft.exe is an Electron application
The archive delivers Microsoft.exe, detected as Trojan.Loader.3261 and built on Electron. It is modular, versioned (1.4.5 at the time of the report) and behaves like a maintained product: it downloads a second encrypted bundle, Nexara.7z, sends system information to a Telegram bot, establishes persistence, attempts privilege escalation, and turns off Windows Defender, UAC, notifications, System Restore and Volume Shadow Copy while adding Defender exclusions. It then injects the next stages into legitimate processes, including RegAsm.exe, dwwin.exe and dwm.exe.This review clearly shows that this attack poses a serious threat even to experienced users, including information security professionals. - Dr.Web
Two evasion modes and a fallback
The loader ships with several ways to avoid inspection. Dr.Web describes a primary Mode3 path and a Mode2 fallback:- Spoofing explorer.exe as the parent process of the loader.
- Disabling Smart App Control by editing the VerifiedAndReputablePolicyState registry value.
- Reloading ntdll.dll from disk to strip security-product hooks, and using Halo's Gate direct system calls.
- Patching EtwEventWrite and AmsiScanBuffer in memory to blind event tracing and script scanning for that process.
- Falling back to Defender exclusions for regasm.exe and dwm.exe, then decrypting and injecting modules with PowerShell if the primary path fails.
What the payloads collect
The final stages are a backdoor, a clipboard hijacker and a stealer. Two copies of BackDoor.AsyncRAT.115 are injected on different ports, which Dr.Web says allows two operators to control the same machine at once. Trojan.InjectNET.14 drops Trojan.Clipper.688 into regasm.exe to swap cryptocurrency wallet addresses in the clipboard, and reports screenshots and host details back through Telegram. JS.Stealer.191 checks for sandboxes and virtual machines before harvesting browser data, FileZilla XML profiles, MobaXterm.ini, Total Commander's wcx_ftp.ini, VPN settings, messenger files, gaming accounts and Discord tokens. The collected data is compressed and sent out through the same Telegram bot.Removing the safety net
The loader also tries to uninstall ESET, McAfee and Malwarebytes, and writes antivirus vendor domains into the hosts file to cut those products off from their update servers. It deletes everything in system32\drivers\etc except a short whitelist, which Dr.Web says is done to prevent the user from creating and using backups. Unused code in the sample points to a further component, an unfinished Electron project named WUDFHost.exe, that could create a service for persistence and re-download Microsoft.exe if it is deleted.Why copy-paste tooling is a supply-chain problem
None of this requires a zero-day or a clever exploit. It requires a person with a deadline, a search engine and a repository that looks close enough to what they need. Security tooling is especially exposed because so much of it is small, single-author and distributed as source that people are expected to run. A parser for scanner output is exactly the kind of thing an analyst downloads, skims and executes. The same applies to any binary pulled from a link: provenance matters more than how useful the file looks. Our guide to verifying downloads over Tor covers the checksum and signature habits that make this kind of substitution harder.Practical habits
A few checks would have caught this chain at several points:- Read build hooks. A PreBuildEvent, a postinstall script or a Makefile step that calls PowerShell is code, not configuration.
- Build tools from a pinned commit and diff that commit against the one you reviewed.
- Run unfamiliar tooling in a disposable virtual machine without clipboard sharing or host mounts.
- Treat .suo, .user and other editor state files as executable content, because in this campaign they were.
- Be wary of repositories that ship setup instructions aimed at beginners; that is a distribution strategy, not a courtesy.