Fake GitHub security projects drop backdoors and infostealers on security researchers

A threat actor compromised more than 2,000 Windows systems used by cybersecurity professionals through malicious GitHub projects posing as security tools, Dr. Web reported on Nov. 6, 2026.

The campaign began about two years ago, initially targeting crypto wallet users before shifting to security researchers, according to Dr. Web. The actor published repositories meant to handle automated scans, security testing, and log analysis tasks, including one fake script to parse, clean, and format Fscan network scanner output. Earlier lures included blockchain games, bots, and cheat tools targeting blockchain and game enthusiasts.

Dr. Web researchers found harmful code in Visual Studio projects, Python scripts, and Go files, hidden behind extended stretches of blank space. In certain Visual Studio projects, a pre-build event routine executes the code before compilation. PowerShell retrieves an encrypted download link to get a modular Electron-based loader called Microsoft.exe, built on a framework for desktop applications.

The loader sets up persistence, gains higher privileges, blocks Windows security and recovery functions, and drops later-stage malware into legitimate processes. Dr. Web documented six evasion techniques in Mode3: disguising explorer.exe as the parent process, disabling Smart App Control via a registry value, restoring original ntdll.dll code from disk, using direct Windows system calls, patching EtwEventWrite in memory to suppress event tracing, and patching AmsiScanBuffer in memory to disrupt antivirus scanning of scripts.

Dr. Web said that when Mode3 cannot launch, the loader switches to Mode2 and uses a PowerShell script to insert payloads into RegAsm.exe. Hosts receive AsyncRAT, a remote access trojan that acts as a backdoor, clipper malware that swaps crypto wallet addresses on the clipboard, and a separate information-stealing tool.

According to Dr. Web, the information stealer gathers browser data, VPN settings, gaming account data, Discord tokens, and FTP client configuration files, sending them through a Telegram bot. The malware also targets ESET, McAfee, and Malwarebytes antivirus tools for removal and attempts to cut their update server connections, while interfering with Windows backups.

Dr. Web researchers found an incomplete component that can keep the loader running and reinstall it after disk removal, suggesting the threat actor is improving the malware. Dr. Web published a full list of indicators of compromise from the campaign.

NordVPN’s Threat Intelligence Team found malicious repositories impersonating KytyPS5 and AnyPS5 among GitHub projects offering PS5 emulation software on Nov. 2, 2026. Visitors to the fake pages received ZIP archives containing Windows executables instead of working emulator software.

Once executed, the malware conducts environment checks and adds Microsoft Defender exclusion rules that cause scans to skip selected files or locations. A suspected infostealer then launches, although NordVPN has not publicly confirmed the full data-collection scope of the payload.

NordVPN’s analysis said environment checks may block execution on virtual machines, cloud systems, computers with less than 2 GB of RAM, or machines without a physical graphics card. A cleanup script deletes the malware’s files, possibly within two minutes after the program runs, and the executables use fabricated publisher names and self-signed certificates to create an appearance of legitimacy.

Some malicious repositories have been removed from GitHub, NordVPN’s researchers said. The researchers warned that similar campaigns can return quickly under different repository names.

Check Point reported on Oct. 29, 2026 that fake GitHub projects imitating desktop ChatGPT and Claude applications distribute a malware chain ending in a cryptocurrency miner, part of the Yoba campaign monitored by researchers for the past two months. Attackers created repositories and GitHub.io pages for fake apps named GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, with malware hosted as ZIP releases.

Each archive contains a signed legitimate executable from OpenAI or Anthropic packaged with a malicious DLL that loads when the victim runs the file, a technique known as DLL sideloading. Check Point stated research shows no compromise of ChatGPT, Claude, OpenAI, or Anthropic, and that attackers misuse legitimate signed binaries tied to those brands.

Check Point said the malware skips infection on computers using a Russian keyboard layout or other Commonwealth of Independent States languages, though Ukrainian is not excluded. After gaining administrator rights, the malware sets up a scheduled task that runs as Local System three minutes following each boot, presenting itself as a Windows Media Player task authored by Microsoft Corporation.

Check Point said the YobaLoader component connects to a Telegram channel called yoba_fanclub, retrieves the profile image, and derives a domain name from part of that picture. The loader queries the domain through Google’s DNS over HTTPS service, retrieves an encrypted record from Catbox, and downloads the file.

Check Point said XMRig cryptocurrency mining software is the final payload, injected into a Windows process and set to contact its mining server through Tor, an anonymity network. The miner stops operating whenever the person using the computer is active.

Check Point advises organizations that discover Yoba to treat the infection as a broad compromise and look past XMRig detection. The loader can execute any executable or PowerShell script provided by the operator, so future waves may deliver different malware families.

In early June 2026, an earlier dropper version ran under a process called Cursor.exe, indicating the lure was the Cursor AI coding agent, according to Check Point. Check Point’s analysis suggests the operator shows signs of Russian origin and works mostly in the UTC-4 time zone. Each repository used a different e-mail address and time zone to hide the operator’s time zone.