Fake Go Modules on GitHub Spread RATs, Vidar, and Cryptominers

Researchers linked 222 GitHub repositories across 190 accounts to a malware distribution campaign dubbed Operation Muck and Load, which used fake Go packages and deceptive software projects to trick developers into importing malicious code. The repositories were dressed up with synthetic GitHub Actions activity, manufactured commit history, and lure themes including cryptocurrency tools, Telegram bots, game cheats, and offensive utilities. Investigators tied the activity to a shared actor email address, ischhfd83@rambler[.]ru, and identified a malicious module, github[.]com/kaleidora/dnsub-scanning-tool, as a first-stage Windows loader.

Once executed, the package launched obfuscated PowerShell, used a dead-drop resolver on public platforms to locate current command-and-control infrastructure, and fetched staged payloads from Muck-themed servers. The infection chain delivered malware including Vidar infostealer, AsyncRAT, Quasar RAT, Remcos-style RATs, spyware, and Monero cryptominers tied to XMRig. Reporting said the operation abused developer trust rather than a flaw in Go itself, but warned that Linux build pipelines, CI/CD runners, developer workstations, and cached credentials remain exposed in mixed-platform environments if malicious modules are pulled into builds.