Fake GitHub security tools infect over 2,000 computers with malware
Original title: Hackers Use Fake GitHub Security Tools to Spread Malware, Infecting Over 2,000 Computers
Doctor Web says Visual Studio and script repos drop AsyncRAT, a clipocurrency clipper, and a browser stealer.
Doctor Web's November 5 investigation describes threat actors using GitHub repositories posed as security utilities, game cheats, and crypto bots. Malicious Visual Studio project files and Python and Go scripts download loaders that deploy two AsyncRAT instances, Trojan.Clipper.688, and JS.Stealer.191. The loader adds scheduled-task and registry persistence, tampers with defenses, and exfiltrates stolen data through Telegram. Doctor Web published several attacker domains.
Unconfirmed: The figure of more than 2,000 infected computers comes from Doctor Web; separate operators sharing one host is described as potential.
- The campaign later added scanning, security-testing, and log-analysis repositories.
- PreBuildEvent routines and hidden script lines run before or during builds.
- JS.Stealer.191 collects browser data, Discord tokens, VPN configs, and FTP client files.
- The loader tries to disable Defender and uninstall ESET, McAfee, and Malwarebytes.
- Published domains include muckanthropic[.]com and muckdeveloper[.]com.
Impact: Remote access, stolen credentials, and swapped crypto addresses
- 1.Block muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com, and muckdeveloper[.]com.
- 2.Review cloned GitHub security or crypto tools before building or running them.
- ATT&CK
- T1204.002 Malicious FileT1059.001 PowerShellT1055 Process InjectionT1053.005 Scheduled TaskT1562.001 Disable or Modify Tools
- Products
- GitHubVisual Studio
- Organizations
- Doctor Web
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | duckdns.org | Published indicators include muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com, and muckdeveloper[.]com. These behavio |
| domain | muckanthropic.com | ough hosts-file modifications. Published indicators include muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com, and muckdevelo |
| domain | muckcoding.com | cators include muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com, and muckdeveloper[.]com. These behaviors expose how appa |
| domain | muckdeveloper.com | hropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com, and muckdeveloper[.]com. These behaviors expose how apparently useful developer u |
From the original article
2 min read at gbhackers.com
Threat actors are distributing malware through GitHub repositories masquerading as security utilities, infecting more than 2,000 computers.
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.