Arctic Wolf Finds 292 Fake GitHub Repositories Distributing BoryptGrab Infostealer
Summary
Arctic Wolf researchers found 292 fake GitHub repositories distributing a BoryptGrab variant. A trojanized DLL sideloaded by a signed updater steals sensitive data and can bypass Chrome App-Bound Encryption through code injection.
Key points
- Arctic Wolf researchers identified 292 repositories impersonating legitimate software and security projects; README links led to spoofed download pages.
- The pages delivered ZIP archives containing a trojanized libcurl.dll and a signed WinGUP updater; running the updater sideloaded the DLL and executed the infostealer in memory.
- The BoryptGrab variant targets data from 19 browsers, 32 cryptocurrency wallets, messaging apps, Windows Credential Manager, and selected user files.
- Researchers observed a previously undocumented capability to bypass Chrome App-Bound Encryption through direct code injection into the browser process.
- The malware compresses stolen data before sending it to a Russia-based command-and-control server. Researchers found no persistence or anti-analysis layer, and staging files were not wiped.
- At the time of Arctic Wolf’s report, GitHub had removed many repositories, but several dozen GitHub Pages redirectors remained active; researchers also shared a YARA rule and indicators of compromise.
Article Details
- Attack Vectors
- Fake GitHub repositories impersonated legitimate software and security projects and linked to malicious download pages.
- Spoofed landing pages delivered ZIP archives containing a trojanized libcurl.dll and a signed WinGUP updater renamed to match the impersonated product.
- When run, gup.exe sideloaded libcurl.dll, which decoded and reflectively executed the infostealer in memory.
- The infostealer collected browser data, cryptocurrency wallet data, messaging and social-media tokens, Windows Credential Manager contents, selected files, screenshots, and system details.
- The malware compressed stolen data and sent it to a Russia-based C2 server.
- Defensive Notes
- Arctic Wolf recommends caution when interacting with unofficial GitHub pages offering free downloads of premium software.
- Arctic Wolf shared a YARA rule for detecting the activity.
- At the time of Arctic Wolf's report, GitHub had removed many malicious repositories, but several dozen GitHub Pages redirectors reportedly remained active.
- The malware reportedly did not establish persistence, and its temporary exfiltration-staging directory was not wiped, leaving forensic traces.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | arctic-wolf[.]github[.]io | Example referrer-domain segment associated with the campaign's malicious landing-page and redirector flow. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware collected Windows Credential Manager contents and selected files from Desktop and Documents.T1041 · Exfiltration Over C2 ChannelThe compressed stolen data was sent to a C2 server.T1055 · Process InjectionThe reported Chrome App-Bound Encryption bypass involved direct code injection into the browser process.T1105 · Ingress Tool TransferThe malicious landing pages delivered ZIP archives containing the updater and trojanized DLL.T1113 · Screen CaptureScreenshots were among the data collected from infected systems.T1204.002 · Malicious FileThe infostealer was executed when a user ran the downloaded executable.T1528 · Steal Application Access TokenThe malware collected messaging and social-media application tokens, including Discord tokens.T1539 · Steal Web Session CookieThe infostealer collected browser cookies and session data.T1555.003 · Credentials from Web BrowsersThe infostealer collected passwords and other data from web browsers.T1560 · Archive Collected DataThe malware compressed collected data before exfiltration.T1574.002 · DLL Side-Loadinggup.exe sideloaded the trojanized libcurl.dll.T1620 · Reflective Code LoadingThe DLL decoded and reflectively executed the embedded infostealer in memory.
Malware
Products
DiscordTelegram sessions, Discord tokens, and Steam session tokensGitHubA threat actor used hundreds of fake GitHub repositories impersonating legitimate software and security projects to spread an infostealer associated with BoryptGrab.Google ChromeThe researchers note that this variant of BoryptGrab exhibits a previously undocumented capability to bypass Chrome’s App-Bound Encryption through direct code injection into the browser process.MaxCredentials for Meta’s Max messaging applicationSteamTelegram sessions, Discord tokens, and Steam session tokensTelegramTelegram sessions, Discord tokens, and Steam session tokensWindows Credential ManagerThe BoryptGrab variant stole data from browsers, cryptocurrency wallets, messaging apps, and Windows Credential Manager.WinGUPThe payload delivered a trojanized libcurl.dll and a signed WinGUP updater to sideload the infostealer.