Affected Systems
Cybersecurity professionals and developers using GitHub repositories for security tools, network scanners, and automation scripts. Over 2,000 Windows systems compromised. Campaign active for ~2 years, recently pivoted from crypto users to security practitioners.
Exploitation Status
Active campaign ongoing since ~2024. Malicious repositories live on GitHub. Delivers AsyncRAT backdoor, clipper malware, and custom infostealer. No CVE assigned (social engineering attack vector).
Business Impact
High risk to security teams and DevOps personnel who clone GitHub repos for security tooling. Malware disables Windows Defender, removes ESET/McAfee/Malwarebytes, blocks security updates, and establishes persistent backdoor access. Steals browser credentials, VPN configs, FTP credentials, gaming accounts, and Discord tokens. Clipboard hijacking targets cryptocurrency transactions. Advanced evasion (AMSI/ETW patching, direct syscalls, ntdll unhooking) complicates detection.
Urgency
🟠Within 24 hours
Recommended Actions
- Audit developer and security team workstations for IoCs published by Dr. Web; hunt for 'Microsoft.exe' Electron loader and AsyncRAT C2 traffic
- Block execution of scripts and binaries from user-writable directories; enforce application whitelisting or Windows Defender Application Control (WDAC) on security team endpoints
- Review GitHub repository cloning activity in the past 6 months; flag repos advertising Fscan parsers, blockchain bots, or security automation with minimal commit history or unknown maintainers
- Enable tamper protection in Microsoft Defender and enforce centralized EDR that cannot be disabled locally; monitor registry changes to Smart App Control and Defender exclusion lists
- Educate security and development staff on supply chain risks from unvetted GitHub projects; mandate code review and sandboxed testing before executing third-party security tools