Security firm Dr. Web says a campaign using malicious GitHub repositories disguised as security tools has been running for about two years and has compromised more than 2,000 Windows systems.
The operation first targeted crypto wallet users with lures such as blockchain games, bots and cheat tools. It later shifted to projects that appeal to security professionals, including scan automation, security testing and log analysis tools. One example was a script presented as a lightweight formatter for output from the Fscan network scanner.
Malicious code was hidden in Visual Studio project files, Python scripts and Go source files, sometimes behind long stretches of whitespace. In some Visual Studio projects, a pre-build event runs the payload before compilation.
In the infection chain, PowerShell fetches an encrypted download link for a modular Electron-based loader named Microsoft.exe. The loader sets up persistence, escalates privileges, disables Windows security and recovery features, and injects the next stage into legitimate processes. Its default mode uses six evasion techniques, including spoofing explorer.exe as the parent process, disabling Smart App Control and patching AMSI and ETW functions in memory.