Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Fake GitHub security tools infect over 2,000 Windows PCs

3 sources · 3 articlesFirst reported Updated ()1
What's new

November 9: Security Affairs says the payload is disguised as a Windows Photos component, the loader disables UAC and System Restore, and an unfinished WUDFHost.exe sits in Lodge.7z.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Doctor Web says fake GitHub security tools have infected more than 2,000 Windows PCs with AsyncRAT, a clipper, and a stealer.

Doctor Web says a two-year campaign that moved from crypto, game, and cheat lures to GitHub security-tool repositories has infected more than 2,000 Windows systems. Hidden Visual Studio, Python, and Go code launches PowerShell that fetches an Electron loader named Microsoft.exe; Security Affairs says the payload is disguised as a Windows Photos component. The loader persists, tampers with defenses, and installs two AsyncRAT copies, a crypto clipper, and a stealer that sends data through Telegram. GBHackers, citing Doctor Web’s November 5 report, names Trojan.Clipper.688 and JS.Stealer.191 plus domains including muckanthropic[.]com. Security Affairs adds that the loader turns off Defender, UAC, and System Restore, and that an unfinished WUDFHost.exe file in Lodge.7z is incomplete.

Key facts
  • Lures include a fake script that claims to parse or clean Fscan scanner output.
  • Loader Mode3 patches AMSI and ETW and restores ntdll.dll, BleepingComputer reports.
  • Mode2 adds Defender exclusions and injects payloads into RegAsm.exe.
  • The stealer takes browser, VPN, FTP, gaming, and Discord data via Telegram.
  • GBHackers lists attacker domains muckanthropic[.]com and muckdeveloper[.]com.
  • AsyncRAT runs as two identical copies on different ports, Security Affairs says.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 5, 2026Doctor Web investigates the fake GitHub security-tool campaign. · GBHackers

What each outlet adds

beyond the shared facts
  • BleepingComputerNames Microsoft.exe modes that patch AMSI and ETW and inject RegAsm.
  • GBHackersPublishes malware family names and attacker domains from the November 5 report.
  • Security AffairsAdds Photos disguise, UAC and System Restore, and unfinished Lodge.7z component.
Vendors
Microsoft
Products
GitHubVisual StudioFscanWindows Defender
Malware
AsyncRATTrojan.Loader.3261Trojan.Clipper.688JS.Stealer.191Trojan.InjectNET.14Microsoft.exe
Organizations
Doctor WebDr. Web

Coverage

oldest first · one row per article · UTC
  1. · 2d ago BleepingComputerFirst report

    Fake GitHub security tools deploy AsyncRAT and an infostealer

    Dr. Web says more than 2,000 Windows systems were hit after a two-year campaign shifted from crypto lures to security-tool repositories.

  2. · 2d ago GBHackers

    Fake GitHub security tools infect over 2,000 computers with malware

    Doctor Web says Visual Studio and script repos drop AsyncRAT, a clipocurrency clipper, and a browser stealer.

  3. · 8h ago Security Affairs

    Fake GitHub security tools infect more than 2,000 PCs

    Doctor Web says the loader disables antivirus, then deploys AsyncRAT, a crypto clipper and a data stealer.