As reported by BleepingComputer, researchers at Dr. Web have uncovered a sustained campaign distributing malicious GitHub repositories masquerading as legitimate security tooling — including fake scripts for parsing Fscan network scanner output, log analysis utilities, and security testing automation. With over 2,000 Windows systems compromised and a two-year operational history, this campaign represents a troubling evolution: threat actors are now targeting the very community tasked with defending against them.

Threat Alert: Web have uncovered a sustained campaign distributing malicious GitHub repositories masquerading as legitimate security tooling — including fake scripts for parsing Fscan network scanner output, log analysis utilities, and security testing automation.

Why This Campaign Is Different

Supply-chain attacks leveraging open-source repositories are not new. What makes this campaign notable is its thematic pivot. The threat actor initially focused on blockchain games, crypto bots, and cheat tools — a demographic known for relaxed security hygiene. The recent shift to security-professional-facing lures demonstrates an understanding that defenders will instinctively trust tooling that appears designed for their own workflows. A repository advertised as a lightweight Fscan output parser is precisely the type of utility a penetration tester or SOC analyst might clone without deep scrutiny during a busy engagement.

This exploits a cognitive blind spot. Security professionals evaluate external code with the assumption that they are the hunters, not the hunted. That overconfidence — combined with GitHub's implicit social proof mechanisms (stars, forks, README polish) — creates an attack surface that traditional security awareness training doesn't address.

Technical Sophistication Worth Noting

The malware's evasion capabilities are above average for commodity-tier tooling. The Electron-based loader, masquerading as 'Microsoft.exe,' employs six distinct evasion techniques in its default operational mode, including:

Why This Campaign Is Different
Process hollowing via explorer.exe as a parent process to evade parent-child analysis
ntdll.dll restoration from disk to remove security product hooks — a technique more commonly seen in advanced malware
Direct syscalls to bypass userland API monitoring
In-memory patching of ETW and AMSI to blind both event tracing and script-level AV scanning

The fallback to Mode2 — which simply adds Microsoft Defender exclusions and injects into RegAsm.exe — suggests the actor builds for environments of varying maturity. The final payload stack (AsyncRAT, clipper, infostealer) and exfiltration via Telegram bot API indicate a financially motivated actor, not a nation-state operation, but the operational discipline is concerning.

The targeting of ESET, McAfee, and Malwarebytes for removal — and the attempt to disconnect them from their management servers — suggests the actor expects these specific products in their victim demographic and has pre-staged countermeasures.

Broader Implications for the Security Community

This campaign underscores a systemic problem: the security industry's reliance on GitHub as a distribution and collaboration platform has created a trust model that is increasingly being weaponized. Unlike package registries (npm, PyPI, RubyGems), GitHub lacks automated malware scanning on repository creation or cloning. Repositories can accumulate stars and forks through organic-looking activity before malicious payloads are introduced via post-publication commits — a technique we've observed in multiple recent campaigns.

The infostealer component is particularly damaging for security professionals. Browser data, VPN configurations, and FTP client credentials from a compromised analyst workstation can yield access to internal tooling, threat intelligence platforms, client environments, and incident response infrastructure. The collection of Discord tokens likely targets security community servers where sensitive operational discussions occur.

Shield53 Recommendations

Immediate Actions

  • Audit cloned repositories: Inventory all GitHub-based tools currently in use across your security and development teams. Prioritize anything cloned in the past 24 months that handles scanner output, log parsing, or network testing.
  • Deploy EDR with memory scanning: Ensure your endpoint detection includes AMSI and ETW tamper detection alerts. The in-memory patching of these components should trigger immediate investigation.
  • Monitor for indicators: Look for processes named 'Microsoft.exe' in non-standard locations, unexpected RegAsm.exe child processes, PowerShell execution originating from Visual Studio build events, and outbound connections to Telegram API endpoints from workstations.
  • Restrict build-time execution: Disable or audit pre-build and post-build events in Visual Studio project files sourced from external repositories. Review .csproj and .vbproj files for embedded PowerShell invocation.

Longer-Term Hardening

  • Implement a repository vetting process: Require security review before any external repository is cloned into production or analysis environments. Check commit history for suspicious whitespace-laden additions.
  • Isolate analysis workstations: Run untrusted tooling in dedicated VMs or containers with no access to corporate VPN, password stores, or internal documentation.
  • Rotate credentials post-incident: If any team member used tools matching this campaign's profile, rotate all browser-stored credentials, VPN configurations, and Discord tokens immediately.
  • Monitor GitHub for impersonation: Set up alerts for repositories that mimic your team's public tooling or use your brand in their descriptions.

The defender community cannot afford to assume immunity from attacks simply because it understands them. This campaign proves that the same curiosity and efficiency that makes security professionals effective also makes them predictable targets. Treat every external repository — even one that looks like it was built for you — as hostile until proven otherwise.