Antivirus vendor Doctor Web reported on 5 November 2026 a campaign that hides malware in GitHub repositories. It says more than 2,000 computers were infected at the time of its research. The first poisoned repositories appeared about two years ago with blockchain-game projects, bots and cheats aimed at crypto users; the campaign then moved to fake security tools — scanning automation, security testing and log analysis — aimed at security professionals. Doctor Web says it is still active.
How it gets in: the repositories include friendly install instructions that tell victims to install Visual Studio and clone the project. The malicious steps hide in Visual Studio project files (.csproj pre-build events and .suo files), so building the project runs them; in Python and Go files the code is pushed out of sight behind long runs of whitespace. Cyber Press names FscanOutput_v2.2.py, presented as a helper for the Fscan network scanner, and resource.go among the poisoned files.
What it installs: a PowerShell downloader looks up where to fetch its next stage through services such as YouTube, Telegram, Google Docs, GitCode and Pastebin. It installs Microsoft.exe (Trojan.Loader.3261), which deploys the AsyncRAT backdoor (BackDoor.AsyncRAT.115), a clipper that swaps cryptocurrency wallet addresses on the clipboard (Trojan.Clipper.688) and an Electron-based stealer (JS.Stealer.191) that goes after browser data, Discord tokens, VPN configurations and FileZilla, MobaXterm and Total Commander FTP files.
It also fights back: Doctor Web says the loader disables Windows Defender and UAC, removes McAfee, ESET and Malwarebytes, edits the hosts file to block security vendors, and interferes with System Restore and backups; it persists through scheduled tasks and registry Run entries and sends data out through a Telegram bot. Indicators of compromise are published in Doctor Web's malware-iocs repository.
