Fake GitHub security tools infect more than 2,000 PCs
Original title: Fake GitHub Security Tools Infect Over 2,000 PCs With Malware
Doctor Web says the loader disables antivirus, then deploys AsyncRAT, a crypto clipper and a data stealer.
Doctor Web found malware in GitHub projects posing as security tools for scanning, testing and log analysis, after an earlier wave aimed at blockchain-game users. Opening a project runs PowerShell that fetches a payload disguised as a Windows Photos component. The Electron loader, Microsoft.exe, disables defenses and delivers AsyncRAT, a clipboard address swapper and a stealer; stolen data is sent through Telegram.
Unconfirmed: The infection count is Doctor Web’s figure from the time of its research, not an independent total.
- Doctor Web says more than 2,000 PCs were infected when it researched the campaign.
- One project claims to analyze and clean results from the Fscan scanner.
- The loader removes McAfee, ESET and Malwarebytes and turns off Defender, UAC and System Restore.
- AsyncRAT runs as two identical copies on different ports.
- An unfinished WUDFHost.exe component inside Lodge.7z is not yet complete.
Impact: Disables defenses, steals data and swaps crypto addresses
- 1.Scan every file downloaded from these GitHub projects before opening or building them.
- 2.Keep antivirus current; the malware removes named security products and blocks vendor domains.
- ATT&CK
- T1204.002 User Execution: Malicious FileT1059.001 Command and Scripting Interpreter: PowerShellT1562.001 Impair Defenses: Disable or Modify ToolsT1115 Clipboard DataT1102 Web Service
- Vendors
- Microsoft
- Products
- GitHubFscanWindows Defender
- Malware
- AsyncRAT
- Organizations
- Doctor Web
From the original article
3 min read at securityaffairs.com
Fake GitHub security tools are spreading malware that disables defenses, steals sensitive data and infects over 2,000 PCs. Cybersecurity firm Doctor Web has found malware hidden in GitHub projects that look like security tools. The campaign targets blockchain game fans and, more recently, information security professionals.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.