Fake GitHub security tools infect over 2,000 PCs, including infosec professionals

On November 9, 2026, Doctor Web documented a campaign that publishes fake security tools on GitHub which disable Windows Defender and deploy AsyncRAT, a clipper and a credential stealer — with more than 2,000 PCs already infected. Vet the provenance of any GitHub tool before you run it, even when it claims to audit or clean up a security scanner.