Fake GitHub security tools infect over 2,000 PCs, including infosec professionals
On November 9, 2026, Doctor Web documented a campaign that publishes fake security tools on GitHub which disable Windows Defender and deploy AsyncRAT, a clipper and a credential stealer — with more than 2,000 PCs already infected. Vet the provenance of any GitHub tool before you run it, even when it claims to audit or clean up a security scanner.
November 9, 2026. Doctor Web has published a report on a campaign that hides malware inside fake security tools hosted on GitHub. More than 2,000 PCs. The researchers counted over 2,000 infected machines at the time of their analysis. The target has shifted. After two years spent hunting blockchain gamers, the attackers are now going after cybersecurity professionals. Why it matters: the tool you download to audit someone else has become the one that compromises you — it kills the antivirus, drops a RAT, and drains crypto wallets in the background.
A campaign that started with blockchain games two years ago
The thread does not begin with security. According to Doctor Web, the campaign kicked off two years ago with Visual Studio projects tied to blockchain games, game bots and cheats. The targets of that era used crypto wallets, and the attackers stashed their code in project files — commands executed before the build, plus PowerShell scripts tucked into configuration files.
The process was deliberately beginner-friendly: the repositories shipped Visual Studio installation instructions and a walkthrough for cloning the project from GitHub. Someone with no technical background could follow the tutorial, compile, run — and compromise themselves. The barrier to entry was lowered for the victim, not the attacker.
What stands out in the report is the continuity. The campaign never stopped. It simply changed audiences. Doctor Web’s researchers describe a group that re-skins its lures to match whatever is trending, without rebuilding its payload infrastructure — the classic signature of a profitable, maintained operation rather than a one-off.
The pivot toward security professionals
The new part is the target. The fresh GitHub repositories claim to offer tools for automated scanning, security testing and log analysis. Doctor Web highlights one that imitates the analysis and cleanup of results from the Fscan scanner — a legitimate tool widely used by both offensive and defensive teams. It is exactly the kind of binary a pentester, a SOC analyst or a rushed sysadmin downloads without isolating, because they are used to opening them.
The trap is as psychological as it is technical. A developer is wary of a “free crypto miner”; a security professional drops their guard around a tool that speaks the vocabulary of their own trade. The report is blunt: the attackers are going after the people whose job it is to spot this sort of thing, exploiting familiarity with the domain’s tooling.
The obfuscation techniques scale with the upgrade. The malicious code is hidden in Python and Go files, using large blocks of whitespace to frustrate review. Some of the fake tools go further: they remove the antivirus installed on the machine before the payload even lands.
An Electron loader that dismantles defenses end to end
The core of the infection is a binary named Microsoft.exe, a modular application built on the Electron framework. The delivery path is deliberately misleading: when the project is opened, a PowerShell script contacts the attackers’ servers and legitimate platforms — YouTube, Telegram, Google Docs, GitCode and Pastebin. A retrieved encrypted string points to an archive that unpacks into a folder disguised as a Windows Photos component.
This loader does not merely run a payload. It disarms the machine:
- it collects system information and forwards it to a Telegram bot;
- it ensures persistence and elevates privileges;
- it disables Windows Defender, UAC, System Restore and shadow copies;
- it adds its own Defender exclusions and injects code into legitimate processes;
- it removes McAfee, ESET and Malwarebytes products.
The default evasion mode, dubbed Mode3, stacks techniques: parent-process spoofing, disabling Smart App Control, removing security hooks from ntdll.dll, direct system calls, and in-memory patching of event tracing (ETW) and the antivirus script scanner. If that path fails, Mode2 takes over with Defender exclusions and injection through PowerShell. Two modes, one outcome: the EDR sees nothing.
Three payloads: a RAT, a clipper, a stealer
Once defenses are down, three payloads take over.
AsyncRAT runs as two identical copies on different ports — a detail suggesting that two operators can drive the same machine in parallel, or that the load is split across two command-and-control backends. It is a full remote-access backdoor: quiet, and battle-tested.
The clipper targets crypto wallets: it swaps addresses copied to the clipboard for the attackers’ own, while taking screenshots. A copy-paste transfer made on the fly lands directly with the operator, with no alert whatsoever.
The stealer does the heavy lifting on data: browser data, FileZilla, MobaXterm and Total Commander configuration files, VPN settings, messenger files, game accounts and Discord tokens. Everything is zipped and exfiltrated via Telegram, while the malware edits the hosts file to block antivirus vendors’ domains — preventing a post-incident signature update.
The whole thing is modular: each stage can be swapped or extended without touching the rest. That is the hallmark of malware under continuous development, not a frozen kit.
An unfinished stage that previews the next releases
Doctor Web found an unfinished component that says a lot about the roadmap. This module, still a work in progress, would be able to install itself as a system service, re-download Microsoft.exe if someone deletes it, manage startup and install updates. The report also mentions a Lodge.7z archive containing an incomplete Electron project whose executable is named WUDFHost.exe — a name that impersonates a legitimate Windows component.
The lesson is stark: this malware is still being written. Today’s unused routines will be tomorrow’s active features. You are not defending against a frozen version, but against an evolving lineage.
Verdict
If you pull security tools from GitHub, provenance becomes your first access control. Stars, a clean README or a technical-sounding name prove nothing: the Doctor Web campaign shows the lure is designed for the practitioners. Download only from official repositories or signed releases, check the history, the account’s creation date and the signatures, and run any unknown binary in an isolated VM with no network — never on a workstation that carries your antivirus and your wallets. If you lead a team, add this case to your internal training: the “I know this tool” reflex is precisely the gap the campaign exploits. If you have already opened one of these repositories, treat the machine as compromised and rebuild it — the Defender exclusions and the hosts-file edit will not be fixed by a scan.