Fake security tools on GitHub are infecting the pros who download them

Hackers are posting fake security tools on GitHub, a public site where people share code, and the people who download them are security workers. Researchers at the company Dr. Web say the fakes install a backdoor and a password-stealing program on Windows computers. They report that more than 2,000 systems have been compromised so far.

What happened

The campaign began about two years ago. At first it aimed at crypto wallet users, with lures such as blockchain games, bots and cheat tools. More recently the attacker switched to projects that promise to automate scans, run security tests and analyze logs. One example is a fake script sold as a light tool to clean up output from the Fscan network scanner.

The bad code is tucked inside Visual Studio project files, Python scripts and Go source files. It hides behind long stretches of blank space, so a quick look at the file shows nothing odd. In some Visual Studio projects, the code runs before the program is even built.

What the malware does

Once running, it downloads a loader named Microsoft.exe. The loader keeps itself on the PC, gains higher access, switches off Windows security and recovery features, and hides its next stage inside legitimate Windows processes. The final payloads are three tools:

• AsyncRAT, a backdoor that gives the attacker remote access.
• A clipper that swaps crypto wallet addresses you copy for the attacker's.
• An infostealer that grabs browser data, VPN settings, FTP settings, gaming accounts and Discord tokens.

The stolen data is sent out through a Telegram bot. The malware also tries to remove ESET, McAfee and Malwarebytes antivirus tools, cut them off from their updates, and interfere with Windows backups.

Who it affects

The targets are people who download code from GitHub and run it on Windows: security workers, developers, crypto wallet users and gamers. Someone who never runs code from GitHub is not the group described in the research. Still, a developer's stolen logins and VPN settings can put an employer at risk too.

What to do

The steps in the alert box above cover how to test tools safely and what to do if you already ran one. The key point is that a tool's description proves nothing about what it does.

What happens next

Dr. Web found an apparently unfinished piece that could re-download the loader if it were deleted. That suggests the attacker is still improving the malware. The researchers published a full list of signs of infection that security teams can check for. The reports do not say how many of the fake projects exist or who is behind them.