Fake GitHub repositories posing as security utilities are being used to infect Windows systems with a loader that delivers AsyncRAT backdoors, a cryptocurrency clipboard hijacker and an information stealer, according to Doctor Web research published Nov. 5, 2026.
How the fake repositories infect machines
Doctor Web said the attackers had infected more than 2,000 PCs at the time of its research. The first infected repositories appeared about two years ago and were aimed at crypto wallet users through blockchain games, bots and cheating tools. The same operation has since shifted toward information security professionals, with repositories presented as tools for scan automation, security testing and log analysis.
Doctor Web found malicious code in Microsoft Visual Studio project files, including .suo and .csproj files, as well as in Python and Go source files. In some Visual Studio projects, the .csproj file used a pre-build event that runs before compilation. Other files contained PowerShell commands or code hidden behind long stretches of whitespace.
One example described by the researchers was a bogus repository advertising a script for parsing, cleaning and formatting output from the Fscan network scanner. That type of lure is aimed at people likely to run unfamiliar utilities while investigating networks or testing systems.
When someone opens or builds a compromised project, malicious code can start a PowerShell script from paths such as C:\Users\Public\Pictures\t.ps1 or C:\Users\Public\Pictures\L.ps1. Doctor Web said the script can query attacker-controlled infrastructure and legitimate services, including Telegram, Google Docs, GitCode, Pastebin and YouTube, before retrieving an encrypted string that leads to an archive called Quixo.7z.
That archive is unpacked to C:\ProgramData\Windows.Microsoft.Photos. The main loader is an Electron-based application named Microsoft.exe, detected by Doctor Web as Trojan.Loader.3261.
What the malware does after infection
The loader collects system information, reports to the attackers through a Telegram bot, sets up automatic restart behavior, attempts privilege escalation and changes several Windows security settings. Doctor Web said it can disable Windows Defender, User Account Control, notifications, System Restore and Volume Shadow Copy Service, while also adding custom Windows Defender exclusions.
The malware also attempts to remove ESET, McAfee and Malwarebytes security tools from the infected computer. Doctor Web said it modifies the Windows hosts file at C:\windows\system32\drivers\etc\hosts and interferes with files in that directory, which can affect access to security-vendor domains and recovery options.
The final payloads include two copies of BackDoor.AsyncRAT.115, which Doctor Web said gives attackers full access to the infected device. A separate payload, Trojan.InjectNET.14, injects a crypto clipper that can replace cryptocurrency wallet addresses copied to the clipboard. While replacing addresses, the malware can take screenshots and send them to the attackers with the active window title, user login and device IP address.
The infection chain also deploys JS.Stealer.191, an Electron-based stealer. Doctor Web said it attempts to detect sandboxes and virtual machines, then collects browser data, FileZilla XML files, MobaXterm configuration data, Total Commander FTP configuration, VPN settings, messenger files, video-game account data, game-platform account data and Discord tokens. The stolen data is compressed and sent through a Telegram bot.
Why this matters beyond one GitHub campaign
This campaign is aimed at the people and machines that often sit close to code, credentials and internal systems. Doctor Web did not report that every infected system exposed source code or cloud credentials, but the combination of remote access, browser-data theft and token collection makes an infected developer or analyst workstation a high-risk foothold.
Separate research published by Apiiro in October found 17,610 FakeGit repositories serving SmartLoader malware. Apiiro said many of those repositories were not newly created; instead, the operator re-aimed existing repositories by changing README download links. Apiiro also reported that hundreds of apparently real developer accounts were carrying the kit, with 219 accounts backed by third-party history that could not be backdated.
Earlier Checkmarx research from 2024 described attackers manipulating GitHub search with frequent automated updates and fake stars to make malicious repositories look more active or more trusted. The Doctor Web campaign is a different case, but the pattern is similar: repository age, public code, search rank, stars and a convincing README are weak trust signals when the build process or install path has not been reviewed.
What development and security teams should check
Teams that allow developers, administrators or security staff to clone and run public GitHub tools should treat this as a workstation-security issue, not only a code-hosting issue.
Review recently cloned or built GitHub projects presented as Fscan helpers, scan-automation tools, security-testing utilities, log-analysis tools, blockchain games, bots or cheat tools.
Inspect Visual Studio .csproj and .suo files for pre-build events, PowerShell commands and unexpected downloads. Inspect Python and Go files for code hidden after long whitespace, encoded strings or suspicious remote fetches.
Review installation instructions, install scripts and post-install steps for remote downloads, encoded PowerShell and unexpected calls to services such as Telegram or Pastebin.
Search Windows endpoints for C:\Users\Public\Pictures\t.ps1, C:\Users\Public\Pictures\L.ps1, C:\ProgramData\Windows.Microsoft.Photos and unexpected Microsoft.exe execution from that location.
Hunt for the network indicators published by Doctor Web, including muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com, muckdeveloper[.]com, 130[.]12.182[.]172 and 130[.]12.182[.]209.
If a machine matches the campaign indicators, isolate it and treat saved browser sessions, Discord tokens, FTP and VPN configuration, repository access and developer credentials used on that machine as exposed until reviewed, revoked or rotated.
Run unfamiliar public tools in disposable virtual machines or containers with no saved browser sessions, repository tokens, cloud keys or access to production systems. Approved internal mirrors and allow-listed tooling reduce the need to run unknown projects directly from public repositories.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
