Fake GitHub Security Tools Deliver Backdoors and Infostealers
Summary
Dr. Web says a campaign using fake GitHub security projects has compromised more than 2,000 Windows systems. Its Electron loader deploys AsyncRAT, clipper malware and an infostealer while evading security tools.
Key points
- Dr. Web reports more than 2,000 Windows systems compromised; the campaign shifted from crypto and gaming lures to fake tools for security scanning, testing and log analysis.
- Malicious code is hidden in Visual Studio project files, Python scripts and Go source files; some Visual Studio projects execute it through a pre-build event.
- PowerShell retrieves an encrypted download link for the Electron-based loader named Microsoft.exe.
- The loader establishes persistence, elevates privileges, disables Windows security and recovery features, and injects malware into legitimate processes.
- In its default Mode3, the loader uses techniques including parent-process spoofing, disabling Smart App Control, restoring ntdll.dll, direct system calls, and patching ETW and AMSI functions.
- If Mode3 fails, Mode2 adds Microsoft Defender exclusions and uses PowerShell to decrypt and inject payloads into RegAsm.exe.
- Payloads include AsyncRAT, clipboard clipper malware and an infostealer that collects browser, VPN, FTP, gaming-account and Discord data; the article says the stolen details are sent through a Telegram bot.
Article Details
- Attack Vectors
- Malicious GitHub repositories were presented as security projects, including a fake Fscan output-processing script.
- Malicious code was concealed in Visual Studio project files, Python scripts, and Go source files behind long stretches of whitespace.
- In some Visual Studio projects, a pre-build event ran the malicious code before compilation.
- PowerShell retrieved an encrypted download link used to fetch the Electron-based loader named Microsoft.exe.
- The loader injected payloads into legitimate processes; when Mode3 failed, Mode2 used PowerShell to decrypt and inject payloads into RegAsm.exe.
- Earlier campaign lures included blockchain games, bots, and cheat tools.
- Defensive Notes
- The loader reportedly disables Windows security and recovery features, adds Microsoft Defender exclusions in Mode2, attempts to remove ESET, McAfee, and Malwarebytes, and interferes with antivirus update connections and Windows backups.
- The loader's reported evasion behaviors include restoring ntdll.dll code from disk, making direct Windows system calls, and patching EtwEventWrite and AmsiScanBuffer in memory.
MITRE ATT&CK
T1005 · Data from Local SystemThe infostealer collects browser data, VPN settings, FTP client configuration files, gaming account data, and Discord tokens from infected hosts.T1027 · Obfuscated Files or InformationMalicious code in project files and source files is concealed behind long stretches of whitespace.T1055 · Process InjectionThe loader injects payloads into legitimate processes, including RegAsm.exe in Mode2.T1059.001 · PowerShellPowerShell retrieves the encrypted download link and is also used in Mode2 to decrypt and inject payloads.T1105 · Ingress Tool TransferPowerShell retrieves a link that downloads the Microsoft.exe loader.T1112 · Modify RegistryThe loader changes a Windows registry value to disable Smart App Control.T1115 · Clipboard DataThe clipper replaces cryptocurrency wallet addresses in the clipboard.T1134.004 · Parent PID SpoofingThe loader makes explorer.exe appear to be the malware's parent process.T1490 · Inhibit System RecoveryThe loader interferes with Windows backups and disables recovery features.T1562.001 · Disable or Modify ToolsThe loader disables Windows security features, adds Microsoft Defender exclusions in Mode2, and attempts to remove antivirus tools.T1562.002 · Disable Windows Event LoggingThe loader patches EtwEventWrite in memory to suppress event tracing in the affected process.
Malware
Products
GitHubFake security tools on GitHub push backdoors and infostealersMicrosoft Defender Antimalware PlatformIf that mode fails to launch, the loader uses Mode2, which adds Microsoft Defender exclusions and uses a PowerShell script to decrypt and inject the payloads into ‘RegAsm.exe.’Microsoft WindowsWeb found that more than 2,000 Windows systems have been compromised so far.PowerShellThe infection chain uses PowerShell to retrieve an encrypted download link that fetches a modular Electron-based loader named ‘Microsoft.exe.’Visual StudioWeb's investigation found malicious code embedded in Visual Studio project files, Python scripts, and Go source files, hidden behind long stretches of whitespace, an old technique that still proves effective.
Tools
Industries
CybersecurityCybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware.GamingThe infostealer collects browser data, VPN settings, FTP client configuration files, gaming account data, and Discord tokens, and exfiltrates the details through a Telegram bot.