Malicious Go Module Uncovered GitHub Malware Lure Network Across 222 Repositories

Researchers identified a malicious Go module, github.com/kaleidora/dnsub-scanning-tool, that posed as a DNS and subdomain scanning utility while delivering a Windows-focused malware chain. The package reportedly launched hidden PowerShell execution and used dead-drop resolver techniques to retrieve follow-on infrastructure, turning a seemingly legitimate developer tool into an initial access vector for staged payload delivery.

The investigation expanded beyond the single package into a broader GitHub lure network spanning 222 repositories across 190 accounts, which researchers tracked as Operation Muck and Load. The activity was linked to Muck-themed infrastructure and multi-stage loading behavior, and reporting included indicators of compromise such as domains, URLs, file hashes, an email address, and Windows file paths tied to staging and payload execution.