Loading story…
An unattributed threat actor has run a large malicious GitHub campaign using at least 292 brand-impersonation repositories and pages to distribute a BoryptGrab-lineage infostealer. The operation used deceptive GitHub profiles and .github repositories that mimicked legitimate software companies and trusted security vendors, including a fake Arctic Wolf GitHub presence, to make the content appear credible to developers and IT users.
The repositories reportedly used marketing-style README files to look legitimate while concealing download links that redirected victims to malicious payloads. Researchers said the activity had been active since 26 June 2026, indicating a broad social-engineering effort that abused GitHub's trust model to lure users seeking software, tools, or vendor resources into downloading credential-stealing malware.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Since 2026-06-26, an unattributed threat actor has operated a large malicious GitHub campaign using at least 292 deceptive brand-impersonation GitHub pages and .github repositories. The repositories impersonate legitimate software brands and trusted security vendors, including a fake Arctic Wolf GitHub page, and use README files with hidden download links to deliver a BoryptGrab-lineage infostealer.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourcemalware.news
Open sourcearcticwolf.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a large-scale GitHub malware distribution campaign that has operated since March 2025, using repositories masquerading as cracked browser extensions, gaming cheats, developer tools, and, more recently, fake AI skills and MCP servers. The activity has been tied to a Vietnamese-speaking operator and spans more than 47 GitHub accounts and 600 malicious ZIP archives, with some accounts believed to have been compromised rather than created solely for abuse. The campaign’s social-engineering lures target both general users and developers seeking unofficial software, automation tools, or AI-related components. The repositories deliver a multi-stage **LuaJIT** loader chain that ultimately installs the **StealC** information stealer. Payloads are fetched from GitHub “dead drop” repositories, then decrypted through layered obfuscation including hex, XOR, `base64url`, and **AES-ECB** before process hollowing is used for injection. Researchers said the malware also resolves command-and-control infrastructure through **Polygon Mainnet** smart contracts, allowing operators to rotate C2 URLs or IPs without changing deployed binaries; telemetry linked the activity to detections such as BitDefender `Gen:Heur.FakeGit.1` and ESET’s `Lua/Agent` family, while infrastructure usage heavily overlapped with bulletproof hosting providers including **ASN 207957 (Serv.host Group Ltd)**.
Jul 22, 2026
Security researchers reported a **FakeGit** campaign using counterfeit GitHub repositories to trick developers into downloading trojanized tools, with Magento developers among the primary targets. The repositories copied code, commit history, and project structure from legitimate open-source deployment, Docker, and configuration projects so that authentic contributor names appeared alongside the fake repos, increasing credibility. Victims were directed to download ZIP archives that contained a LuaJIT runtime, a batch launcher, and obfuscated Lua payloads that installed Windows malware, including a remote access trojan and keylogger; Sansec also published malicious GitHub accounts, repository names, and SHA1 hashes tied to the operation. A related lure expanded the campaign beyond Magento by impersonating a security automation project named **`n8n-CyberSecurity-Workflows`**, targeting red team, blue team, and AppSec users with GitHub stars, an MIT license, and a README download button. Analysis of the downloaded archive found a Lua-based trojan loader using DLL sideloading through a renamed Lua 5.1 interpreter to execute obfuscated bytecode, with VirusTotal detections labeling the payload as **`trojan.fakegit/runner`**. The malware was also observed contacting a Polygon blockchain RPC endpoint, behavior researchers said aligns with crypto-clipper or wallet-drainer activity, indicating the FakeGit operation is using trusted developer platforms to distribute credential theft and broader financially motivated malware.
Aug 14, 2026
An ongoing campaign uses SEO-optimized GitHub repositories impersonating LastPass Authenticator and at least 39 other brands to distribute the previously undocumented **Rapuncel** infostealer. Victims are routed through counterfeit download pages, GitHub Pages trust signals, and manipulated 404 redirects to oversized ZIP archives containing a renamed Microsoft Visual Studio CoreCLR Debugger binary that sideloads a malicious DLL. Rapuncel deploys `Alinubx.sys`, a Microsoft-signed kernel driver disguised as an NVIDIA component, to terminate up to 145 antivirus and EDR products, including Protected Process Light-protected tools. It steals browser credentials, cryptocurrency-wallet data, Windows Credential Manager contents, messaging and gaming sessions, screenshots, targeted documents, and host information before exfiltrating data to `2.26.126[.]50`. Researchers assess it as a likely BoryptGrab variant delivered with the Cruciferra PUROSANGUE crypter; technical indicators also suggest a possible Russian origin.
Sep 19, 2026