Fake GitHub Security Tools Are Hacking the Hackers

Someone is booby-trapping GitHub projects that look like security tools, and the people cloning them are exactly the ones who should know better. Security Affairs reports on research from Doctor Web, which found malicious code hidden in Visual Studio, Python and Go projects posing as scanning, testing and log-analysis helpers, including one that claims to tidy up output from the Fscan scanner. Doctor Web counted more than 2,000 infected PCs. The same operation spent the previous two years luring crypto-game players with fake bots and cheats.

muckanthropic[.]com · muckcoding[.]com · muckdeveloper[.]com
muckduck.duckdns[.]org
130.12.182[.]172 · 130.12.182[.]209

C:\ProgramData\Windows.Microsoft.Photos\Microsoft.exe
C:\Users\Public\Pictures\t.ps1 · C:\Users\Public\Pictures\L.ps1
Quixo.7z · Nexara.7z · Nexara\Nvdia.7z · Lodge.7z (WUDFHost.exe)
FscanOutput_v2.2.py (SHA1 b6d65832e95355f6864197b3cd81b9a5d1807036)
app.asar of Microsoft.exe (SHA1 b9d6a75a254420af3b6ec82be99fb9b5b9202253)

Source article: Fake GitHub Security Tools Infect Over 2,000 PCs With Malware
Publisher: Security Affairs (Pierluigi Paganini)
Published: Nov. 9, 2026
URL: https://securityaffairs.com/202717/malware/fake-github-security-tools-infect-over-2000-pcs-with-malware.html

Executive Summary

An unnamed, financially motivated operation is planting malware in GitHub repositories that pose as useful projects, and has recently moved from blockchain-game bots, cheats and token tools aimed at crypto-wallet holders to fake security tooling (scanning automation, security testing, log analysis, an Fscan output “beautifier”) aimed at information security professionals; Doctor Web, which tracks the components as Trojan.Loader.3255, Trojan.Starter.8458/8459, Python.Downloader.271, PowerShell.Packed.270, Trojan.Loader.3261, JS.Stealer.191, Trojan.InjectNET.14/Trojan.Clipper.688 and BackDoor.AsyncRAT.115, counted more than 2,000 infected PCs and says the first infected repositories appeared about two years ago. No vendor has attributed the activity to a named actor. The chain starts when the victim builds a Visual Studio project (a PreBuildEvent in the .csproj or a PowerShell command in the .suo file) or runs a Python or Go file whose malicious line is hidden behind long runs of whitespace; a PowerShell stage written to C:\Users\Public\Pictures\t.ps1 or L.ps1 reads an encrypted pointer from Pastebin, YouTube, Telegram, Google Docs, GitCode or attacker domains, downloads Quixo.7z from attacker servers or GitHub and unpacks it to C:\ProgramData\Windows.Microsoft.Photos. There the Electron loader Microsoft.exe downloads Nexara.7z, reports system details to a Telegram bot, gains persistence and elevated rights, disables Windows Defender, UAC, notifications, System Restore and Volume Shadow Copy, adds Defender exclusions, removes McAfee, ESET and Malwarebytes, rewrites the hosts file, and, using parent PID spoofing, a Smart App Control registry change, ntdll unhooking, direct syscalls and in-memory ETW and AMSI patches, injects two AsyncRAT instances and a clipboard clipper into RegAsm.exe, dwwin.exe or dwm.exe before launching an Electron stealer that takes browser, FTP, SSH client, VPN, messenger, gaming and Discord data and exfiltrates it through Telegram. The objective is remote control of the host, credential and session theft and cryptocurrency theft, and the impact on a security professional’s workstation extends to every system its stored SSH, VPN and FTP credentials reach. Hunt leads, false positive expectations and indicators are detailed below; Doctor Web published SHA1 hashes and network indicators but no detection rules.

ATT&CK chain: Resource Development → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Collection → Command and Control → Exfiltration → Impact

Hunt Lead Grid

muck* Domain and Staging IP Sweep

Doctor Web lists four attacker domains, muckanthropic[.]com, muckcoding[.]com, muckdeveloper[.]com and the dynamic-DNS host muckduck.duckdns[.]org, plus the addresses 130.12.182[.]172 and 130.12.182[.]209. They appear at every stage: the .suo loader (Trojan.Loader.3255) requests paths such as hxxps[:]//muckanthropic[.]com/LG/Api-Certificate, hxxps[:]//muckcoding[.]com/LG-LW/Api-Certificate and hxxp[:]//130.12.182[.]172/ApiCertificate.txt; the PowerShell stage requests /LG/MicrosoftCur and /MicrosoftCur.txt; Quixo.7z, Nexara.7z and Lodge.7z are served from 130.12.182[.]172 and muckduck.duckdns[.]org; and version and update checks hit /LG/SysVersion, /LG/SysUpdate and /LG/MicVersion. The same URLs have fallback copies on Pastebin, YouTube, Telegram channels (dwmic, lwmic2, lodgesys), Google Docs, GitCode (account LastWer) and GitHub (account tb78, repositories BreakFree and expresso). Example poisoned repositories Doctor Web named include Trivexqbk/FscanOutput-Beautify, Trivexqbk/Frp-Quick-Configuration-Panel, Auraleaf/SharpUserIP-login-logs-controller and Olivaire/sleep-duck-eye. The detection logic is a retrospective match of DNS, proxy and firewall logs against the four domains (and any subdomain of them) and the two IPs, plus a proxy-log match on the GitHub, GitCode and Telegram paths above.

Use recursive resolver logs, secure web gateway or proxy logs with full URLs, and firewall or NetFlow records. Sweep back at least two years, since Doctor Web dates the first infected repositories to about two years ago, and at minimum 180 days for the security-tool wave. Scope first to developer, red-team, SOC and researcher workstations and to any build server that clones public repositories. Block the four domains and the muckduck subdomain at DNS, but do not block duckdns.org, pastebin.com, youtube.com, docs.google.com, gitcode.com or github.com as a whole, because legitimate users need them; match the exact account and resource paths instead. A hit on any of the domains or IPs from a workstation should go straight to host triage under the second lead, and because stolen SSH, VPN and FTP configurations are part of the payload, treat every credential stored on that host as exposed.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1105 (Ingress Tool Transfer); Command and Control → T1102.001 (Web Service: Dead Drop Resolver)

Sources: “Fake GitHub Security Tools Infect Over 2,000 PCs With Malware”, Security Affairs, Nov. 9, 2026, https://securityaffairs.com/202717/malware/fake-github-security-tools-infect-over-2000-pcs-with-malware.html (source article); “Insolence beyond belief: Threat actors target information security developers on GitHub”, Doctor Web, Nov. 5, 2026, https://news.drweb.com/show/?i=15311&lng=en&c=5 (additional source, same campaign); “Indicators of compromise: Trojan.Loader.3261”, Doctor Web malware-iocs repository, Nov. 2026, https://github.com/DoctorWebLtd/malware-iocs/blob/master/Trojan.Loader.3261/README.adoc (additional source, same campaign)

Fake Windows Photos Folder and Public Pictures Scripts

The PowerShell stage is written to C:\Users\Public\Pictures\t.ps1 or C:\Users\Public\Pictures\L.ps1, and the Quixo.7z archive it downloads is unpacked to C:\ProgramData\Windows.Microsoft.Photos, a name chosen to resemble the Windows Photos app, whose main executable is Microsoft.exe, an Electron application with its code in resources\app.asar. Microsoft.exe then retrieves Nexara.7z, which holds the encrypted modules boot_f, kernel_f and thread_f, a manifest\config.json whose b_f, k_f and t_f values hold their keys, thumbcache_11.dll through thumbcache_20.dll, and Nexara\Nvdia.7z containing the stealer (SearchFilterHost.exe per Doctor Web’s hash table); a further Lodge.7z carries an unfinished WUDFHost.exe. The detection logic is a file-creation and process-image check for any of these paths and names, together with a hash match on the SHA1 values in the appendix.

Use EDR file-creation and process-start telemetry, plus a one-off sweep with your endpoint management tool for the directory C:\ProgramData\Windows.Microsoft.Photos and for *.ps1 files in C:\Users\Public\Pictures. Sweep back as far as EDR retention allows; the files persist on disk, so a live filesystem query catches older infections. Scope to all Windows endpoints, with priority on developer and security staff. False positives should be close to zero, since the legitimate Photos app lives under WindowsApps, not ProgramData; do not allowlist by the file name Microsoft.exe, SearchFilterHost.exe or WUDFHost.exe, because the last two are real Windows binary names, so anchor on the full path and the absence of a Microsoft signature. Hash blocking alone is the wrong primary control because Doctor Web says the loader is actively updated (version 1.4.5 at the time of writing) and the archives change; detect the paths. Any hit means the host has run the full chain, so isolate it, collect the folder for analysis and reset every credential the user stores.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Defense Evasion → T1036.005 (Masquerading: Match Legitimate Resource Name or Location)

Sources: Doctor Web report (above), additional source; Doctor Web IOC repository (above), additional source; source article (above)

Visual Studio Build Spawning PowerShell with Network Access

In the Visual Studio variant, the repository ships a .csproj with a PreBuildEvent that runs malicious code before compilation (Doctor Web’s Trojan.Starter.8458) and .suo files containing a PowerShell command (Trojan.Loader.3255); the newer security-tool lures add Go (resource.go, Trojan.Starter.8459) and Python (FscanOutput_v2.2.py, Python.Downloader.271) files with the payload hidden behind long runs of whitespace. The repositories even include instructions for installing Visual Studio and cloning, which tells you the expected victim flow: clone, open, build. The behavioral anchor is devenv.exe or MSBuild.exe (or python.exe and go.exe for the other variants) spawning powershell.exe, usually hidden or with an encoded command, which then makes an outbound HTTP request and writes a .ps1 into C:\Users\Public\Pictures. Build the rule as parent process in that set, child PowerShell with network activity or a file write outside the project directory within a short window.

Use EDR process lineage and network telemetry from developer and analyst workstations, and Sysmon process-creation and network events where EDR is not present. Baseline 30 days of legitimate pre-build PowerShell in your own projects, then sweep back 180 days. Scope to interactive workstations where people clone public code; build servers that run only internal repositories are a separate, quieter baseline. Allowlist by repository path and by the exact script your own projects call, never by the parent process name, because devenv.exe and MSBuild.exe are exactly what the attacker relies on. Blocking PowerShell outright on developer machines is usually the wrong control and breaks real tooling; constrained language mode, script block logging and a policy that unknown repositories open only in a disposable VM are better fits. A hit tied to a freshly cloned repository from an unfamiliar GitHub account should be triaged as an infection under the second lead. The lead generalizes to every campaign that weaponizes Visual Studio build events, which is a recurring technique against researchers.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1127.001 (Trusted Developer Utilities Proxy Execution: MSBuild); Execution → T1059.001 (Command and Scripting Interpreter: PowerShell)

Sources: Doctor Web report (above), additional source; source article (above)

Defender Exclusions for RegAsm and DWM plus Security Tool Removal

Microsoft.exe disables Windows Defender, UAC, notifications, System Restore and the Volume Shadow Copy service, adds its own Defender exclusions (in Mode2, specifically for regasm.exe and dwm.exe), uninstalls McAfee, ESET and Malwarebytes products, and, in Mode3, changes the Smart App Control registry value VerifiedAndReputablePolicyState to switch that feature off. The stealer also rewrites C:\Windows\System32\drivers\etc\hosts to make antivirus vendor domains unreachable and deletes every file in that folder except hosts, networks, protocol, services and lmhosts.sam. Each of these is a single-source behavior you can alert on: Defender exclusion changes naming regasm.exe or dwm.exe (Windows Defender operational log events for configuration changes, or the Exclusions registry keys), any write to VerifiedAndReputablePolicyState, unexpected uninstall of an endpoint security product, VSS or System Restore being disabled, and non-installer processes writing to the hosts file.

Use Windows Defender operational logs, registry auditing or EDR registry telemetry, application uninstall events, and EDR file-write telemetry on the drivers\etc folder. Sweep back 180 days. Scope to all Windows endpoints, since the crypto-game wave targeted home users and the newer wave targets security staff. Expect a small number of benign exclusion changes from software deployment tooling; allowlist by the deploying process’s signed path and the expected exclusion list, not by user. Do not rely on Defender’s own alerting to catch this, since the malware’s purpose is to turn Defender off; collect these events in a place the endpoint cannot edit, and enable tamper protection. Two or more of these behaviors on one host within an hour is a compromise and should be escalated, not tuned; the combination generalizes to most commodity loaders that kill security tools before dropping a payload.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1685 (Disable or Modify Tools); Defense Evasion → T1112 (Modify Registry); Impact → T1490 (Inhibit System Recovery)

Sources: Doctor Web report (above), additional source; source article (above)

Dead-Drop Chain then Network Activity from Injected System Binaries

The PowerShell stage and the loader both resolve their next download through a rotating set of dead drops: a Pastebin raw paste, a YouTube video, a public Telegram channel preview (t.me/s/), a Google Docs document, a GitCode file and the attacker domains, each holding an encrypted string that decrypts to the archive URL. After the archives land, the loader spoofs explorer.exe as parent, unhooks ntdll.dll, makes direct syscalls (Halo’s Gate), patches EtwEventWrite and AmsiScanBuffer in memory, and injects the decrypted boot_f and kernel_f (two AsyncRAT instances on different ports) and thread_f (the injector that loads the clipper) into RegAsm.exe, dwwin.exe or dwm.exe; it then tests C2 reachability with PowerShell and netstat, and the clipper and stealer send screenshots, system details and zipped stolen data to a Telegram bot. The correlation to build is a sequence on one host: a script interpreter contacting three or more of the dead-drop services within a few minutes, followed by a .7z download from a non-corporate host, followed by outbound TCP connections, especially to the Telegram Bot API or to unusual ports, from RegAsm.exe, dwwin.exe or dwm.exe, which normally make no outbound connections at all.

Use EDR process and network telemetry joined on process ID and host, proxy logs with URLs for the dead-drop stage, and DNS logs. Baseline outbound connections from RegAsm.exe, dwwin.exe and dwm.exe for 30 days (most environments will see none), then sweep back 180 days. Scope to all Windows endpoints, with developer and security workstations first. False positives come from users who simply browse YouTube or Telegram; the anchor that removes them is the initiating process (powershell.exe, not a browser) and the following archive download and system-binary network activity. Blocking Telegram or Pastebin entirely is a policy choice, not a detection, and would not stop the attacker’s own domains; ETW patching also means some EDR telemetry from the injected process can go quiet, so rely on network-side evidence for the final step. Any confirmed sequence is an active AsyncRAT session with a second operator slot, so isolate the host and escalate. The lead generalizes to the many loaders that use public dead drops and inject into .NET system binaries.

Hunt Lead Level: 3 (Elite)

ATT&CK: Command and Control → T1102.001 (Web Service: Dead Drop Resolver); Defense Evasion, Privilege Escalation → T1055 (Process Injection); Exfiltration → T1567 (Exfiltration Over Web Service)

Sources: Doctor Web report (above), additional source; Doctor Web IOC repository (above), additional source; source article (above)

Hash Appendix

Repository lures and PowerShell stage

SHA1s come from Doctor Web’s IOC repository (an additional source on the same campaign); Doctor Web did not publish MD5 or SHA256 values, and a spot check of OTX AlienVault returned no record, so those are not available.

MD5s

(not available)  # .suo -> Visual Studio solution user options file with PowerShell command (Trojan.Loader.3255), sample 1
(not available)  # .suo -> Visual Studio solution user options file with PowerShell command (Trojan.Loader.3255), sample 2
(not available)  # .suo -> Visual Studio solution user options file with PowerShell command (Trojan.Loader.3255), sample 3
(not available)  # *.csproj -> project file with malicious PreBuildEvent (Trojan.Starter.8458)
(not available)  # resource.go -> Go source with whitespace-hidden payload (Trojan.Starter.8459)
(not available)  # FscanOutput_v2.2.py -> fake Fscan output tool (Python.Downloader.271)
(not available)  # t.ps1 / L.ps1 -> C:\Users\Public\Pictures, packed (PowerShell.Packed.270)
(not available)  # t.ps1 / L.ps1 decoded -> downloader (PowerShell.DownLoader.3080)
(not available)  # t.ps1 / L.ps1 -> downloader variant (PowerShell.DownLoader.3080)

SHA1s

a15b30b88546d715179f68b4c1581914e05fd3f1  # .suo -> Visual Studio solution user options file with PowerShell command (Trojan.Loader.3255), sample 1
85fc0f50963c77d576e52852a51af0ee7824a7ce  # .suo -> Visual Studio solution user options file with PowerShell command (Trojan.Loader.3255), sample 2
49958ff87c15b78e329aa57334a0349ecfe9d911  # .suo -> Visual Studio solution user options file with PowerShell command (Trojan.Loader.3255), sample 3
8d41c48ba6567c2f6cae2990c18b3e20c79afebe  # *.csproj -> project file with malicious PreBuildEvent (Trojan.Starter.8458)
149ad5d02974a4867d0fe9b1176b246b36017c40  # resource.go -> Go source with whitespace-hidden payload (Trojan.Starter.8459)
b6d65832e95355f6864197b3cd81b9a5d1807036  # FscanOutput_v2.2.py -> fake Fscan output tool (Python.Downloader.271)
96e2cd242f1b6ef98e3b8dd1dc387309ca30055d  # t.ps1 / L.ps1 -> C:\Users\Public\Pictures, packed (PowerShell.Packed.270)
dfb1f3ad1b3b3b910d3b986b206d0b3ef469f5dd  # t.ps1 / L.ps1 decoded -> downloader (PowerShell.DownLoader.3080)
57cd17e88e4f64efb9681fa45c8845c337c05751  # t.ps1 / L.ps1 -> downloader variant (PowerShell.DownLoader.3080)

SHA256s

(not available)  # .suo -> Visual Studio solution user options file with PowerShell command (Trojan.Loader.3255), sample 1
(not available)  # .suo -> Visual Studio solution user options file with PowerShell command (Trojan.Loader.3255), sample 2
(not available)  # .suo -> Visual Studio solution user options file with PowerShell command (Trojan.Loader.3255), sample 3
(not available)  # *.csproj -> project file with malicious PreBuildEvent (Trojan.Starter.8458)
(not available)  # resource.go -> Go source with whitespace-hidden payload (Trojan.Starter.8459)
(not available)  # FscanOutput_v2.2.py -> fake Fscan output tool (Python.Downloader.271)
(not available)  # t.ps1 / L.ps1 -> C:\Users\Public\Pictures, packed (PowerShell.Packed.270)
(not available)  # t.ps1 / L.ps1 decoded -> downloader (PowerShell.DownLoader.3080)
(not available)  # t.ps1 / L.ps1 -> downloader variant (PowerShell.DownLoader.3080)

Loader, stealer and injected payloads

SHA1s come from Doctor Web’s IOC repository; MD5 and SHA256 were not published and OTX AlienVault had no record of the Microsoft.exe app.asar hash checked. Note that SearchFilterHost.exe and WUDFHost.exe are names of genuine Windows binaries reused here; these hashes are of the malicious Electron app.asar bundles, so detect on path and signature rather than file name.

MD5s

(not available)  # app.asar (Microsoft.exe) -> C:\ProgramData\Windows.Microsoft.Photos, Electron loader (Trojan.Loader.3261)
(not available)  # led.dll -> loader component (Trojan.Starter.8447)
(not available)  # app.asar (SearchFilterHost.exe) -> from Nexara\Nvdia.7z, Electron stealer (JS.Stealer.191)
(not available)  # app.asar (WUDFHost.exe) -> from Lodge.7z, unfinished module (Trojan.Siggen34.29867)
(not available)  # *.ps1 -> %TEMP% random name, Mode2 injector (PowerShell.Inject.245)
(not available)  # boot_f decrypted -> injected AsyncRAT instance 1 (BackDoor.AsyncRAT.115)
(not available)  # kernel_f decrypted -> injected AsyncRAT instance 2 (BackDoor.AsyncRAT.115)
(not available)  # thread_f decrypted -> injector for the clipper (Trojan.InjectNET.14)

SHA1s

b9d6a75a254420af3b6ec82be99fb9b5b9202253  # app.asar (Microsoft.exe) -> C:\ProgramData\Windows.Microsoft.Photos, Electron loader (Trojan.Loader.3261)
4d177b8143102965b510b8cf098578c788ec915b  # led.dll -> loader component (Trojan.Starter.8447)
ef3edf9846ec945806e5c3fa95e3cd207f142520  # app.asar (SearchFilterHost.exe) -> from Nexara\Nvdia.7z, Electron stealer (JS.Stealer.191)
79b1156b89bf906cadcc93b68f67d528e289ed2d  # app.asar (WUDFHost.exe) -> from Lodge.7z, unfinished module (Trojan.Siggen34.29867)
68805c7ca2af697a71c10e7da9694a8202396142  # *.ps1 -> %TEMP% random name, Mode2 injector (PowerShell.Inject.245)
ed3b7ec91ce882aa235fed14877ad58514f53de9  # boot_f decrypted -> injected AsyncRAT instance 1 (BackDoor.AsyncRAT.115)
1ad7549378c2af3be2417426cc41852e4d7b6206  # kernel_f decrypted -> injected AsyncRAT instance 2 (BackDoor.AsyncRAT.115)
b83b3cd9ee7f00365308429f58c71170f5f93acc  # thread_f decrypted -> injector for the clipper (Trojan.InjectNET.14)

SHA256s

(not available)  # app.asar (Microsoft.exe) -> C:\ProgramData\Windows.Microsoft.Photos, Electron loader (Trojan.Loader.3261)
(not available)  # led.dll -> loader component (Trojan.Starter.8447)
(not available)  # app.asar (SearchFilterHost.exe) -> from Nexara\Nvdia.7z, Electron stealer (JS.Stealer.191)
(not available)  # app.asar (WUDFHost.exe) -> from Lodge.7z, unfinished module (Trojan.Siggen34.29867)
(not available)  # *.ps1 -> %TEMP% random name, Mode2 injector (PowerShell.Inject.245)
(not available)  # boot_f decrypted -> injected AsyncRAT instance 1 (BackDoor.AsyncRAT.115)
(not available)  # kernel_f decrypted -> injected AsyncRAT instance 2 (BackDoor.AsyncRAT.115)
(not available)  # thread_f decrypted -> injector for the clipper (Trojan.InjectNET.14)

References Appendix

• “Fake GitHub Security Tools Infect Over 2,000 PCs With Malware”, Security Affairs (Pierluigi Paganini), Nov. 9, 2026, https://securityaffairs.com/202717/malware/fake-github-security-tools-infect-over-2000-pcs-with-malware.html (source article; campaign summary)
• “Insolence beyond belief: Threat actors target information security developers on GitHub”, Doctor Web, Nov. 5, 2026, https://news.drweb.com/show/?i=15311&lng=en&c=5 (additional source; infection chain, modes, payloads, paths)
• “Indicators of compromise: Trojan.Loader.3261”, Doctor Web malware-iocs repository on GitHub, Nov. 2026, https://github.com/DoctorWebLtd/malware-iocs/blob/master/Trojan.Loader.3261/README.adoc (additional source; SHA1 hashes, domains, IPs, URLs)
• OTX AlienVault indicator lookup for b9d6a75a254420af3b6ec82be99fb9b5b9202253, checked Nov. 9, 2026, https://otx.alienvault.com/indicator/file/b9d6a75a254420af3b6ec82be99fb9b5b9202253 (no record)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/