{"id":4096,"date":"2026-11-08T09:48:19","date_gmt":"2026-11-08T17:48:19","guid":{"rendered":"https:\/\/cyber.mag212.com\/fake-github-security-tools-prebuild-backdoors-infostealers\/"},"modified":"2026-11-08T09:48:19","modified_gmt":"2026-11-08T17:48:19","slug":"fake-github-security-tools-prebuild-backdoors-infostealers","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/fake-github-security-tools-prebuild-backdoors-infostealers\/","title":{"rendered":"Fake GitHub ‘Security Tools’ Use Hidden Build Hooks to Drop AsyncRAT and Infostealers on 2,000+ PCs"},"content":{"rendered":"\n

For about two years, one unnamed threat actor has seeded GitHub with trojanized projects. Its lures have moved from crypto-game bots and cheats to fake “security tools” aimed at pentesters, SOC analysts and security developers. Doctor Web says more than 2,000 Windows PCs were infected when it did its research. Building or running one of these repositories was enough to install a heavily evasive Electron loader, which then delivered AsyncRAT, a crypto clipper and a Telegram-exfiltrating stealer. Security professionals keep VPN profiles, SSH\/FTP client configs and client credentials on their workstations, and that is exactly what this malware collects.<\/p>\n\n\n\n

What<\/strong><\/td>Trojanized GitHub repositories posing as security utilities, game bots and crypto tools<\/td><\/tr>
Reported<\/strong><\/td>Doctor Web report dated 5 November 2026; BleepingComputer coverage 6 November 2026<\/td><\/tr>
Actor<\/strong><\/td>A single, unattributed actor; first repositories appeared about two years ago<\/td><\/tr>
Scale<\/strong><\/td>More than 2,000 Windows PCs infected at the time of Doctor Web’s research (vendor figure, not independently verified)<\/td><\/tr>
Trigger<\/strong><\/td>Visual Studio PreBuildEvent in .csproj<\/code>, PowerShell in .suo<\/code>, or whitespace-hidden code in .py<\/code>\/.go<\/code> files<\/td><\/tr>
Malware<\/strong><\/td>Trojan.Loader.3261 (Microsoft.exe<\/code>), BackDoor.AsyncRAT.115, Trojan.Clipper.688, JS.Stealer.191<\/td><\/tr>
CVE<\/strong><\/td>None. This is social engineering plus abuse of build features, not a vulnerability<\/td><\/tr>
IOCs<\/strong><\/td>17 SHA-1 hashes, 4 domains, 2 IPs, 9 example repositories in DoctorWebLtd\/malware-iocs<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What happened<\/h2>\n\n\n\n

Doctor Web found malicious code in Visual Studio projects hosted in infected GitHub repositories. The first wave targeted crypto-wallet users with blockchain-game projects, game bots and cheats. One lure was tied to Catizen, a Telegram-based game platform, and came with step-by-step Visual Studio instructions written for less technical users. The actor later switched to projects that claim to automate scanning, security testing and log analysis. One example, reported by BleepingComputer, presented itself as a lightweight tool for parsing, cleaning and formatting output from the Fscan network scanner. Doctor Web’s IOC list names it Trivexqbk\/FscanOutput-Beautify<\/code>, alongside eight other example repositories.<\/p>\n\n\n\n

Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n

How the attack works<\/h2>\n\n\n\n

Stage 0: the trigger.<\/strong> Early repositories shipped a .csproj<\/code> with a PreBuildEvent<\/code>. Visual Studio runs that event before compilation, so pressing Build runs the attacker’s command. Some repositories also carried .suo<\/code> (solution user options) files that contained a PowerShell command. In the later security-tool lures, Python and Go files hid the payload with what Doctor Web calls “malicious code concealed behind a large number of whitespaces”. The malicious statement sits far to the right of an innocent line, past the edge of a browser or editor viewport.<\/p>\n\n\n\n

Stage 1: PowerShell.Packed.270.<\/strong> The script is written to C:\\Users\\Public\\Pictures\\t.ps1<\/code> or L.ps1<\/code>. It does not hard-code its next hop. It reads an encrypted string from attacker servers or from legitimate services (Pastebin, YouTube, Telegram, Google Docs, GitCode) and decrypts it into a download link for Quixo.7z<\/code>. That archive is pulled from attacker infrastructure or a GitHub release and unpacked to C:\\ProgramData\\Windows.Microsoft.Photos<\/code>.<\/p>\n\n\n\n

Stage 2: Trojan.Loader.3261.<\/strong> Microsoft.exe<\/code> is a modular Electron application (version 1.4.5 at the time of analysis). It downloads Nexara.7z<\/code>, which holds the encrypted modules and a config, and reports system information to a Telegram bot. It escalates privileges and disables Defender, UAC, notifications, System Restore and VSS. It removes ESET, McAfee and Malwarebytes if they are installed, and edits the hosts<\/code> file to block antivirus vendors’ domains. It also deletes other files in drivers\\etc<\/code>, which defeats users who keep copies of the hosts file there.<\/p>\n\n\n\n

Deployment runs in one of two main modes. Mode3<\/strong> (default) does the following:<\/p>\n\n\n\n