GitHub Repos: Backdoors & Infostealers in Fake Security Tools

At-A-Glance Incident Diagnostic Telemetry

---

Executive Incident Briefing (2-Minute CISO Brief)

1. Strategic Incident Overview

Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. The campaign, which started about two years ago, initially targeted crypto wallet users but recently shifted focus to publishing malicious repositories for automating scans, security testing, and log analysis. Researchers at Dr. Web found over 2,000 compromised Windows systems and identified six evasion techniques in the loader's Mode3 mode.

The infection chain uses PowerShell to retrieve an encrypted download link that fetches a modular Electron-based loader named 'Microsoft.exe.' The loader establishes persistence, elevates privileges, disables Windows security features, and injects malware into legitimate processes. The final payloads delivered are the AsyncRAT backdoor, clipper malware, and an information stealer that collects browser data, VPN settings, and gaming account information.

The threat actor is working to improve the malware with new features, as evidenced by an unfinished component that could help keep the loader running and download it again if removed from the host's disk.

2. Business Impact & Perimeter Exposure

The campaign has compromised over 2,000 Windows systems, and the malware attempts to remove antivirus tools, disconnect them from their update servers, and interfere with Windows backups. The AsyncRAT backdoor and clipper malware can replace crypto wallet addresses in the clipboard, and the information stealer collects sensitive data, including browser data, VPN settings, and gaming account information.

3. Compliance & Governance Blast Radius

The campaign may trigger regulatory triggers, including CISA KEV/BOD, GDPR Art. 33, NIS2, SEC 8-K, and HIPAA, based on affected sector/geography.

---

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

The malicious repositories on GitHub are designed to target crypto wallet users, blockchain enthusiasts, and game enthusiasts. The infection chain begins with a PowerShell script that retrieves an encrypted download link, which fetches a modular Electron-based loader named 'Microsoft.exe.' The loader, also known as Mode3, establishes persistence on the infected host, elevates its privileges, disables Windows security and recovery features, and injects the next-stage (malware) into legitimate processes.

The loader uses six evasion techniques in Mode3, including disabling Windows Defender, adding Microsoft Defender exclusions, and using a PowerShell script to decrypt and inject payloads into 'RegAsm.exe.' The final payloads delivered to the host are the AsyncRAT backdoor, clipper malware that replaces crypto wallet addresses in the clipboard, and an information stealer.

The information stealer collects browser data, VPN settings, FTP client configuration files, gaming account data, and Discord tokens, and exfiltrates the details through a Telegram bot. The malware also attempts to remove ESET, McAfee, and Malwarebytes antivirus tools from the infected computer, tries to disconnect them from their update servers, and interferes with Windows backups.

Adversary Ingress & Lateral Traversal Pipeline

The infection chain begins with a PowerShell script that retrieves an encrypted download link, which fetches a modular Electron-based loader named 'Microsoft.exe.' The loader, also known as Mode3, establishes persistence on the infected host, elevates its privileges, disables Windows security and recovery features, and injects the next-stage (malware) into legitimate processes. The loader uses six evasion techniques in Mode3, including disabling Windows Defender, adding Microsoft Defender exclusions, and using a PowerShell script to decrypt and inject payloads into 'RegAsm.exe.'

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Profile & Exploitation Telemetry

Unattributed

---

Detection & SOC Mitigation Playbook

1. Patch Deployment & Workaround Engineering

Review official vendor security bulletins and deploy released security hotfixes across all production and staging environments immediately.

2. Network & Perimeter Defenses

• Restrict administrative ingress to dedicated, non-routable management subnets requiring hardware MFA.
• Enforce strict egress inspection to drop outbound connection attempts to unauthorized public IP space.

3. Endpoint Detection & Hunting Query

Sigma Rule: GitHub Repos Behavioral Detection

rule: backdoor_loader
  metadata:
    category: backdoor
    family: AsyncRAT
  selection:
    process.name: Microsoft.exe
  condition:
    process.args: contains 'Mode3'

Microsoft Sentinel Hunting Query (KQL)

SecurityEvent | where EventID == 4688 and ProcessName == 'Microsoft.exe' and CommandLine contains 'Mode3'

4. Verification & Diagnostic Audit Checklist

Remediation Checklist

• Review and remove any suspicious Visual Studio project files, Python scripts, and Go source files from the system
• Update Windows Defender and Microsoft Defender to the latest version
• Remove any malicious registry keys and values
• Run a full system scan with an antivirus tool
• Review and update any compromised credentials

Verification Checklist

• Verify that all suspicious files and registry keys have been removed
• Confirm that Windows Defender and Microsoft Defender are up-to-date
• Review system logs for any signs of malware activity
• Verify that all compromised credentials have been updated

---

Indicators of Compromise (IOCs)

No specific binary hashes were published in the authoritative advisory; hunt using behavioral telemetry and detection rules above.

---

Frequently Asked Questions (FAQ)

1. Is GitHub Repos actively exploited in the wild?

While no mass exploitation has been publicly observed to date, the severity of the flaw warrants urgent patch deployment ahead of weaponization.

2. Which systems, applications, and perimeters are affected?

The vulnerability primarily impacts GitHub Repos installations exposed to public-facing internet traffic or unauthenticated internal network segments.

3. What immediate remediation or patch should organizations deploy today?

Deploy the official security hotfixes released by the vendor immediately. If patching cannot be completed today, implement network ingress restrictions and isolate management interfaces.

4. How can security operations teams detect and hunt for this threat?

Defenders should monitor process creation logs for abnormal shell executions under web servers (e.g. bash, powershell under nginx/httpd) using the provided Sigma rule and Microsoft Sentinel KQL query.