Malicious GitHub Projects Deploy Backdoors, Infostealers

More than 2,000 Windows systems have been compromised so far, according to researchers at cybersecurity company Dr. Web.

Shift in targets: from crypto games to security tooling

Dr. Web says the campaign began about two years ago, initially using lures that included blockchain games, bots, and cheat tools aimed at blockchain and game enthusiasts. In recent months the threat actor changed tack and began publishing malicious repositories that appear to be tools for automating scans, security testing, and log analysis. One example identified by the researchers was a fake script advertised as a lightweight solution to parse, clean, and format output from the Fscan network scanner.

How the malicious code is concealed in source files

The researchers found infected Visual Studio project files, Python scripts, and Go source files with malicious code hidden behind long stretches of whitespace — an old obfuscation technique that Dr. Web says still proves effective. In some Visual Studio projects a pre-build event routine runs the hidden code before compilation, enabling execution as soon as a developer or automated build triggers the project.

The infection chain: PowerShell, Microsoft.exe, and persistence

Dr. Web describes an infection chain that begins with a PowerShell command that retrieves an encrypted download link and uses it to fetch a modular Electron-based loader named “Microsoft.exe.” That loader then establishes persistence on the host, elevates privileges, disables Windows security and recovery features, and injects the next-stage malware into legitimate processes.

Loader evasion techniques: Mode3 (default) and Mode2 fallback

The loader’s default Mode3 contains multiple anti-detection measures that Dr. Web cataloged. These include:

• Making explorer.exe appear to be the malware’s parent process
• Changing a Windows registry value to disable Smart App Control
• Restoring original ntdll.dll code from disk to remove hooks added by security software
• Making direct Windows system calls that are harder for security tools to intercept
• Patching EtwEventWrite in memory to suppress event tracing in the affected process
• Patching AmsiScanBuffer in memory to interfere with antivirus scanning of scripts

If Mode3 fails to launch, the loader switches to Mode2. In Mode2 the loader adds Microsoft Defender exclusions and uses a PowerShell script to decrypt and inject payloads into RegAsm.exe.

Final payloads, data exfiltration, and active interference with security tools

Dr. Web reports the final payloads delivered by the campaign are the AsyncRAT backdoor, clipper malware that replaces cryptocurrency wallet addresses in the clipboard, and an information stealer. The infostealer collects browser data, VPN settings, FTP client configuration files, gaming account data, and Discord tokens, then exfiltrates the information through a Telegram bot, the researchers say.

The malware also attempts to remove ESET, McAfee, and Malwarebytes antivirus tools from infected machines, tries to disconnect those products from their update servers, and interferes with Windows backups. Dr. Web additionally found a seemingly unfinished component that could reinstall the loader or keep it running if it were removed from disk, a finding the researchers say suggests the threat actor is actively working to improve the malware.

What this means for technologists, open-source maintainers, and end users

• Technologists and security teams: monitor for the specific behaviors observed by Dr. Web — PowerShell retrieval of encrypted links, the presence of an Electron loader named “Microsoft.exe,” injections into RegAsm.exe, changes that disable Smart App Control, and attempts to add Microsoft Defender exclusions — and apply the indicators of compromise Dr. Web published.
• Open-source maintainers and code reviewers: closely inspect Visual Studio projects and other contributed source files for pre-build event routines and unusual whitespace obfuscation, and treat unsolicited or unfamiliar repositories claiming to parse or format scanner output with extra scrutiny.
• End users and developers who install third-party tools: be cautious about installing or running security utilities and parsers from unfamiliar GitHub repositories; Dr. Web’s findings show malicious projects can masquerade as lightweight tools for scanning and analysis.

Dr. Web has shared a complete list of indicators of compromise observed in the campaign. The attack sequence — hidden code in source files, PowerShell retrieval of an encrypted link, a modular Electron loader that disables protections, and final payloads that steal data and target security products — underscores how supply-chain and source-code deception remain potent avenues for attackers.

Source: BleepingComputer — Fake security tools on GitHub push backdoors and infostealers