Loading story…
Researchers reported a malware campaign that used fake installers and plugins on GitHub and SourceForge to impersonate popular software including ChatGPT, Claude, AutoTune, Kontakt, and Ableton Live, ultimately delivering the Deno-based backdoor DinDoor. The operation was promoted through compromised YouTube channels that posted AI-generated videos linking to malicious repositories; those videos reportedly drew more than 50,000 views before takedowns. Infection chains typically relied on malicious MSI installers or PowerShell-based loaders that installed Scoop and WinGet, then deployed the Deno runtime to fetch and execute staged JavaScript payloads from attacker-controlled infrastructure.
Once installed, DinDoor established persistence, profiled infected systems, and fetched additional malware including a Deno-based RAT capable of remote execution, data theft, screenshot capture, SOCKS5 proxying, and browser credential theft. Researchers said the malware also targeted Telegram, Discord, Lightcord, more than 50 crypto wallet extensions, and at least 10 crypto wallet applications. A standout capability used Microsoft Edge, the Chrome DevTools Protocol, and WebRTC to stream victim screens peer-to-peer while blending malicious traffic with legitimate browser activity. GitHub removed the identified repositories, but researchers warned the operators are likely to keep recreating malicious accounts and projects on trusted platforms.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Malwarebytes reported that the campaign also used a lighter 'agent-lite' variant alongside DinDoor. The variant leveraged Cloudflare Workers to help anonymize command-and-control communications.
After the malicious repositories were reported, GitHub removed the identified repositories hosting the fake software lures. Researchers warned the operators were likely to continue creating new accounts and repositories on legitimate platforms.
Technical analysis showed DinDoor establishing persistence, profiling infected systems, and deploying additional malware including a Deno-based RAT. Reported capabilities included data theft, remote execution, screenshot capture, browser and crypto wallet theft, SOCKS5 proxying, WebSocket communications, and a peer-to-peer screen-streaming mode abusing Edge/Chrome DevTools Protocol and WebRTC.
The campaign was promoted through compromised YouTube channels posting AI-generated promotional videos that linked to the malicious GitHub and SourceForge repositories. The videos collectively drew more than 50,000 views, increasing victim exposure.
Researchers uncovered a malware distribution campaign using fake installers and plugins impersonating popular software such as ChatGPT, Claude, AutoTune, Kontakt, and Ableton Live on GitHub and SourceForge. The lures delivered the Deno-based backdoor DinDoor through MSI files or PowerShell scripts that installed Scoop, WinGet, and the Deno runtime to execute staged payloads.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcemalware.news
Open sourcemalwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked **222 GitHub repositories** across **190 accounts** to a malware distribution campaign dubbed **Operation Muck and Load**, which used fake Go packages and deceptive software projects to trick developers into importing malicious code. The repositories were dressed up with synthetic GitHub Actions activity, manufactured commit history, and lure themes including cryptocurrency tools, Telegram bots, game cheats, and offensive utilities. Investigators tied the activity to a shared actor email address, `ischhfd83@rambler[.]ru`, and identified a malicious module, `github[.]com/kaleidora/dnsub-scanning-tool`, as a first-stage Windows loader. Once executed, the package launched obfuscated PowerShell, used a dead-drop resolver on public platforms to locate current command-and-control infrastructure, and fetched staged payloads from Muck-themed servers. The infection chain delivered malware including **Vidar infostealer**, **AsyncRAT**, **Quasar RAT**, **Remcos-style RATs**, spyware, and **Monero cryptominers** tied to XMRig. Reporting said the operation abused developer trust rather than a flaw in Go itself, but warned that Linux build pipelines, CI/CD runners, developer workstations, and cached credentials remain exposed in mixed-platform environments if malicious modules are pulled into builds.
Jul 11, 2026
Researchers detailed a **DinDoor** backdoor campaign that delivers malware through MSI installers and abuses the legitimate **Deno** runtime to blend malicious activity with trusted software. Two analyzed samples, `Installer_v1.21.66.msi` and `migcredit.pdf.msi`, both fingerprint infected hosts and beacon to command-and-control infrastructure, but use different execution chains, payload delivery methods, and callback timing. One sample contacted `serialmenot[.]com` using a hardcoded JWT embedded in the C2 path, and decoded campaign metadata linked the infrastructure to activity previously associated with **MuddyWater/Seedworm** and **CastleLoader**. The second sample used a double-extension lure likely themed around **MigCredit** and relied on obfuscated JavaScript with a separate C2 path and beacon interval. Hunt.io said distinctive HTTP response traits across the infrastructure enabled identification of **20 active DinDoor C2 servers** spanning multiple autonomous systems. The findings suggest DinDoor is not tied to a single operator, but instead appears to function as a **shared or multi-tenant malware platform** used by multiple threat actors.
Jun 29, 2026
Researchers reported a large-scale GitHub malware distribution campaign that has operated since March 2025, using repositories masquerading as cracked browser extensions, gaming cheats, developer tools, and, more recently, fake AI skills and MCP servers. The activity has been tied to a Vietnamese-speaking operator and spans more than 47 GitHub accounts and 600 malicious ZIP archives, with some accounts believed to have been compromised rather than created solely for abuse. The campaign’s social-engineering lures target both general users and developers seeking unofficial software, automation tools, or AI-related components. The repositories deliver a multi-stage **LuaJIT** loader chain that ultimately installs the **StealC** information stealer. Payloads are fetched from GitHub “dead drop” repositories, then decrypted through layered obfuscation including hex, XOR, `base64url`, and **AES-ECB** before process hollowing is used for injection. Researchers said the malware also resolves command-and-control infrastructure through **Polygon Mainnet** smart contracts, allowing operators to rotate C2 URLs or IPs without changing deployed binaries; telemetry linked the activity to detections such as BitDefender `Gen:Heur.FakeGit.1` and ESET’s `Lua/Agent` family, while infrastructure usage heavily overlapped with bulletproof hosting providers including **ASN 207957 (Serv.host Group Ltd)**.
Jul 22, 2026