Severity: High | Priority: 1
A malware campaign is using GitHub repositories made to look like security tools to infect the people most likely to trust them: security professionals, penetration testers and developers. The repositories pose as vulnerability scanners, security-testing utilities and log-analysis tools. Earlier versions of the campaign targeted cryptocurrency users with fake blockchain games, game bots and cheats. More than 2,000 computers had been infected at the time of the research. Hiding the malicious code inside software that security staff routinely download and build makes the campaign especially dangerous, because their machines often hold privileged access, credentials and client data.
The malicious code is hidden in places users rarely inspect:
Simply opening or building the project starts the infection. The hidden PowerShell downloads an archive, unpacks it into C:\ProgramData\Windows.Microsoft.Photos, and launches a loader named Microsoft.exe. The loader attempts to gain administrator rights, sets itself to run at startup, adds itself to Microsoft Defender’s exclusions, disables User Account Control, and turns off Windows security logging and script scanning. It then injects its payloads into legitimate Windows processes. These are two copies of the AsyncRAT remote-access trojan, a clipboard clipper that swaps copied cryptocurrency wallet addresses for the attacker’s own, and a stealer that takes browser data, saved passwords, VPN and FTP credentials, and Discord tokens, sending them to the attackers through Telegram.
On any machine that triggers these signatures, isolate it and treat every credential, token and key used on it as stolen. Check for the folder C:\ProgramData\Windows.Microsoft.Photos, a file named Microsoft.exe outside the Windows system folders, PowerShell scripts such as t.ps1 in C:\Users\Public\Pictures, and unexpected Microsoft Defender exclusions. Rebuild the machine from a clean image. From a clean device, rotate passwords, VPN credentials, API keys, SSH keys and cloud tokens, and move any cryptocurrency to a new wallet. To reduce risk, ask security and development staff to review project files, build steps and source code before opening or building any repository from GitHub, including those presented as security tools. Build untrusted code only in isolated virtual machines, and alert on PowerShell launched by Visual Studio or other development tools.