Loading story…
A sophisticated malware campaign has been uncovered in which threat actors use GitHub to distribute a new Remote Access Trojan (RAT) called PyStoreRAT. The attackers reactivated dormant GitHub accounts or created new ones to publish repositories masquerading as legitimate OSINT tools, DeFi bots, and AI chat wrappers. These repositories, often promoted on social media and artificially boosted in popularity, were designed to appeal to IT administrators, cybersecurity professionals, and open-source intelligence researchers. Once the repositories gained trust and visibility, the attackers introduced malicious code through subtle 'maintenance' updates, enabling the silent deployment of PyStoreRAT.
PyStoreRAT is a modular, multi-stage malware capable of executing a variety of payloads, including EXE, DLL, PowerShell, MSI, Python, JavaScript, and HTA modules. It profiles victim systems and can deploy additional threats such as the Rhadamanthys information stealer and Python Loader. Many of the fake tools hosted on GitHub were non-functional or provided only minimal placeholder features, serving primarily as a delivery mechanism for the malware. The campaign demonstrates a calculated abuse of GitHub's trust model and highlights the risks of downloading and executing code from seemingly reputable open-source repositories.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting described PyStoreRAT as a fileless RAT hidden in fake GitHub repositories, emphasizing its ability to avoid writing payloads to disk and evade traditional detection. This coverage broadened the victim focus to developers in addition to IT and security professionals.
Follow-on coverage detailed that PyStoreRAT establishes persistence through scheduled tasks disguised as NVIDIA updates and targets cryptocurrency wallet files. Reporting also highlighted the use of social media promotion and GitHub metric manipulation to boost the malicious repositories' reach.
Morphisec Threat Labs publicly reported the campaign and described PyStoreRAT as a stealthy, adaptive RAT with rotating command-and-control infrastructure, removable-drive propagation, and evasion checks for security products. The report also noted Russian-language artifacts and said several malicious repositories had been identified and removed while others remained active.
After the repositories gained popularity, the attackers introduced malicious commits that turned them into loaders for a multi-stage infection chain. The campaign delivered the newly identified PyStoreRAT remote access trojan and, in some cases, the Rhadamanthys information stealer.
Threat actors reactivated dormant GitHub accounts and published AI-generated repositories themed as development, GPT, and OSINT tools to attract IT administrators, cybersecurity professionals, developers, and OSINT researchers. The repositories were made to look legitimate and were promoted to gain visibility and trust.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcehackread.com
Open sourcethehackernews.com
Open sourcemorphisec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a stealthy malware campaign targeting enterprise administrators, DevOps engineers, and security analysts by impersonating trusted administrative and developer utilities in malicious MSI installers. The operation used SEO poisoning to push victims toward spoofed tool listings and a dual-stage GitHub distribution chain in which benign-looking facade repositories redirected users to secondary repositories hosting the real payload, enabling operators to rotate malware quickly while preserving search credibility. At least 44 GitHub facade repositories spoofing IT tools were observed between December 2025 and early April 2026. The payload, **EtherRAT**, is a multi-stage Node.js remote access trojan that downloads Node.js at runtime, establishes registry-based persistence, and executes through `conhost.exe` with a `--headless` argument to reduce visibility. Researchers said the malware uses layered `AES-256-CBC` encryption and retrieves its live command-and-control endpoint through public Ethereum RPC services and a hardcoded smart contract, effectively using the blockchain as a dead-drop resolver that complicates domain and IP takedowns. Reporting linked the campaign to prior EtherRAT and EtherHiding activity and said the tradecraft overlaps with malware previously associated with **Lazarus Group**, while also noting code similarities to **Tsundere**, a malware family tied in other research to **MuddyWater (APT34)**.
Jun 29, 2026
Researchers documented several malware campaigns that used fake software and trojanized packages to deliver credential theft and remote-access payloads. On Windows, a fake *Resident Evil 9* mod from GitHub triggered a `curl | cmd` chain that deployed hidden batch, JavaScript, portable Node.js, portable Python, and an in-memory Go payload with browser theft, wallet targeting, hVNC-style control, webcam-related code, and exfiltration via Wormhole/B2 and Gofile; a separate fake AI video player installer led through Python bytecode, shellcode, and protected .NET loaders to **PureRAT**, which persisted through the `Run` key and communicated over authenticated WebSockets with `agent.sm-veo.com`. Another Windows campaign, dubbed **Operation TURB00**, used a Go loader and decoy console program to launch **Vidar** in memory, steal browser and application data, and install persistence through `agt.dll` and the `CadenceOptimizer` service running under `svchost` as `LocalSystem`. On macOS, analysts reversed a fully undetected **Atomic macOS Stealer (AMOS)** sample distributed as a signed DMG, bypassed its anti-VM checks, and recovered an AppleScript payload that stole browser data, wallet files, Telegram Desktop data, documents, and system information before exfiltrating to `95.164.53.3/contact`. In the software supply chain, a malicious PyPI package, `nhmpy 2.4.7`, masqueraded as NumPy while using a `.pth` file and an obfuscated JavaScript payload executed through Bun to harvest developer, cloud, CI/CD, registry, SSH, wallet, messaging, VPN, and AI-assistant secrets; it then spread using stolen GitHub tokens and malicious GitHub Actions workflows. Separately, a public Windows local privilege escalation exploit named **REDSUN** showed how attackers could turn standard-user access into `NT AUTHORITY\SYSTEM` by abusing a TOCTOU flaw involving NTFS and the Cloud Files API, creating a potential post-compromise path for malware already running on a host.
Jul 12, 2026
Researchers reported a large-scale GitHub malware distribution campaign that has operated since March 2025, using repositories masquerading as cracked browser extensions, gaming cheats, developer tools, and, more recently, fake AI skills and MCP servers. The activity has been tied to a Vietnamese-speaking operator and spans more than 47 GitHub accounts and 600 malicious ZIP archives, with some accounts believed to have been compromised rather than created solely for abuse. The campaign’s social-engineering lures target both general users and developers seeking unofficial software, automation tools, or AI-related components. The repositories deliver a multi-stage **LuaJIT** loader chain that ultimately installs the **StealC** information stealer. Payloads are fetched from GitHub “dead drop” repositories, then decrypted through layered obfuscation including hex, XOR, `base64url`, and **AES-ECB** before process hollowing is used for injection. Researchers said the malware also resolves command-and-control infrastructure through **Polygon Mainnet** smart contracts, allowing operators to rotate C2 URLs or IPs without changing deployed binaries; telemetry linked the activity to detections such as BitDefender `Gen:Heur.FakeGit.1` and ESET’s `Lua/Agent` family, while infrastructure usage heavily overlapped with bulletproof hosting providers including **ASN 207957 (Serv.host Group Ltd)**.
Jul 22, 2026