Threat actors are distributing malware through GitHub repositories masquerading as security utilities, infecting more than 2,000 computers.
According to Doctor Web’s November 5 investigation, the campaign targets cybersecurity professionals alongside blockchain gaming enthusiasts, weaponizing Visual Studio projects and Python and Go scripts to deploy remote access backdoors, cryptocurrency clippers, and credential stealers.
The operation initially used repositories promoting blockchain games, cryptocurrency bots, and cheats, then expanded into scanning automation, security testing, and log analysis.
Malicious .csproj files contain PreBuildEvent routines that execute before compilation, while .suo files carry PowerShell commands. Python and Go variants conceal malicious statements behind extensive whitespace, making casual source inspection less effective.
Instructions explaining Visual Studio installation and repository cloning further lower the barrier to execution. Execution launches PowerShell.Packed.270 through scripts such as C:UsersPublicPicturest.ps1.
The downloader retrieves encrypted strings from attacker infrastructure or legitimate services, including YouTube, Telegram, Google Docs, GitCode, and Pastebin. Decryption reveals a Quixo.7z download location.
Its contents are extracted into C:ProgramDataWindows.Microsoft.Photos, delivering Microsoft.exe, an Electron application detected as Trojan.Loader.3261. The loader subsequently downloads Nexara.7z, containing encrypted modules and configuration files.
The loader’s Mode3 deployment combines PPID spoofing with Smart App Control tampering, ntdll.dll unhooking, and Halo’s Gate syscall execution.
It assigns explorer.exe as the apparent parent process and modifies VerifiedAndReputablePolicyState to weaken application controls. Additional AMSI and ETW patching targets AmsiScanBuffer and EtwEventWrite, suppressing script inspection and telemetry.
Decrypted boot_f, kernel_f, and thread_f payloads are injected into RegAsm.exe, dwwin.exe, or dwm.exe. If deployment fails, Mode2 extracts encrypted thumbcache DLLs and reconstructs PowerShell.Inject.245 from configuration data. The script decrypts payloads and injects them into RegAsm.exe.
Mode3non and Handler provide alternative execution paths. Ultimately, two AsyncRAT instances establish remote access over different ports, potentially allowing separate operators to control one host simultaneously.
Trojan.InjectNET.14 additionally injects Trojan.Clipper.688 into regasm.exe to replace cryptocurrency wallet addresses and transmit screenshots through Telegram.
The Electron-based JS.Stealer.191 performs virtualization and sandbox checks before collecting browser passwords, cookies, autofill records, Discord tokens, VPN configurations, and messaging files.
Doctor Web stated that it also targets FileZilla XML files, MobaXterm.ini, and Total Commander’s wcx_ftp.ini. Collected information is compressed and exfiltrated through an attacker-controlled Telegram bot.
The loader establishes persistence through scheduled tasks and registry Run entries, while attempting privilege escalation and disabling Defender, UAC, System Restore, and VSS.
It also attempts to uninstall ESET, McAfee, and Malwarebytes and redirects antivirus domains through hosts-file modifications. Published indicators include muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com, and muckdeveloper[.]com.
These behaviors expose how apparently useful developer utilities become delivery mechanisms for sustained surveillance, credential compromise, and cryptocurrency theft.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
