Fake GitHub security tools deploy AsyncRAT and an infostealer
Original title: Fake security tools on GitHub push backdoors and infostealers
Dr. Web says more than 2,000 Windows systems were hit after a two-year campaign shifted from crypto lures to security-tool repositories.
Dr. Web reports that malicious GitHub projects posing as security tools install a backdoor and an information stealer on Windows hosts. The actor previously used crypto, game, and cheat lures, then published repositories for scanning, security testing, and log analysis. Hidden code in Visual Studio, Python, and Go files launches a PowerShell chain that fetches an Electron loader named Microsoft.exe, which persists, raises privileges, weakens defenses, and injects AsyncRAT, a crypto clipper, and a stealer.
Unconfirmed: The count of more than 2,000 compromised systems is Dr. Web’s finding; the extra persistence component is described as seemingly unfinished.
- One lure is a fake script for parsing Fscan scanner output.
- The loader’s default Mode3 patches AMSI and ETW and restores ntdll.dll.
- Mode2 adds Defender exclusions and injects payloads into RegAsm.exe.
- The stealer takes browser, VPN, FTP, gaming, and Discord data via Telegram.
- The malware also tries to remove ESET, McAfee, and Malwarebytes.
Impact: Backdoor access plus stolen credentials and swapped crypto addresses
- 1.Avoid untrusted GitHub security projects, especially Visual Studio pre-build events.
- 2.Check hosts for Microsoft.exe, AsyncRAT, and Dr. Web’s published indicators.
- ATT&CK
- T1204.002 User Execution: Malicious FileT1059.001 Command and Scripting Interpreter: PowerShellT1055 Process InjectionT1562.001 Impair Defenses: Disable or Modify ToolsT1567 Exfiltration Over Web Service
- Products
- Fscan
- Malware
- AsyncRATMicrosoft.exe
- Organizations
- Dr. Web
From the original article
2 min read at bleepingcomputer.com
Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.