Operation Muck and Load

Operation Muck and Load is a Windows malware distribution campaign linked with high confidence to activity associated with the ischhfd83 persona, whose aliases include Muck. The name is a campaign tracking label rather than a definitive attribution boundary. Its confirmed lure network encompasses 222 GitHub repositories across 190 accounts, targeting developers and people seeking cryptocurrency utilities, wallet integrations, trading automation, messaging bots, game cheats, and tools for novice cybercriminals. The operation distributes malicious software through repositories and packages that impersonate legitimate tools. A malicious Go module advertised as a DNS and subdomain scanner instead launched hidden PowerShell commands to initiate a multilayer infection chain. The loader used Base64 encoding, XOR encryption, certutil, and PowerShell execution-policy bypass. Public platforms served as redundant dead-drop resolvers for encrypted payload locations, allowing the loader to fall back to alternative services when individual locations became unavailable. Payloads were delivered through password-protected archives, staged in a location masquerading as a Microsoft Photos installation, and executed with hidden windows. Associated payloads include AsyncRAT, Quasar, Remcos-style remote access trojans, Vidar, other loaders and spyware, and XMRig-related Monero miners. These support information theft, remote access, and illicit cryptocurrency mining. Automated GitHub Actions workflows generated frequent artificial commits to make repositories appear actively maintained and produced extensive Go module version proliferation. GitHub removed reported repositories, and the Go security team blocked the malicious module from its proxy; redundant delivery infrastructure and automated repository maintenance increase the operation's resilience to disruption.