Loading story…
Researchers identified a malicious Go module, github.com/kaleidora/dnsub-scanning-tool, that posed as a DNS and subdomain scanning utility while delivering a Windows-focused malware chain. The package reportedly launched hidden PowerShell execution and used dead-drop resolver techniques to retrieve follow-on infrastructure, turning a seemingly legitimate developer tool into an initial access vector for staged payload delivery.
The investigation expanded beyond the single package into a broader GitHub lure network spanning 222 repositories across 190 accounts, which researchers tracked as Operation Muck and Load. The activity was linked to Muck-themed infrastructure and multi-stage loading behavior, and reporting included indicators of compromise such as domains, URLs, file hashes, an email address, and Windows file paths tied to staging and payload execution.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The investigation expanded beyond the single module to a broader GitHub lure network spanning 222 repositories across 190 accounts. Researchers tracked the activity cluster as Operation Muck and Load and published related indicators of compromise.
Researchers found the Go module github.com/kaleidora/dnsub-scanning-tool masquerading as a DNS/subdomain scanner while exposing a Windows-focused malware delivery chain using hidden PowerShell execution and dead-drop resolver techniques.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked **222 GitHub repositories** across **190 accounts** to a malware distribution campaign dubbed **Operation Muck and Load**, which used fake Go packages and deceptive software projects to trick developers into importing malicious code. The repositories were dressed up with synthetic GitHub Actions activity, manufactured commit history, and lure themes including cryptocurrency tools, Telegram bots, game cheats, and offensive utilities. Investigators tied the activity to a shared actor email address, `ischhfd83@rambler[.]ru`, and identified a malicious module, `github[.]com/kaleidora/dnsub-scanning-tool`, as a first-stage Windows loader. Once executed, the package launched obfuscated PowerShell, used a dead-drop resolver on public platforms to locate current command-and-control infrastructure, and fetched staged payloads from Muck-themed servers. The infection chain delivered malware including **Vidar infostealer**, **AsyncRAT**, **Quasar RAT**, **Remcos-style RATs**, spyware, and **Monero cryptominers** tied to XMRig. Reporting said the operation abused developer trust rather than a flaw in Go itself, but warned that Linux build pipelines, CI/CD runners, developer workstations, and cached credentials remain exposed in mixed-platform environments if malicious modules are pulled into builds.
Jul 11, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026
Security researchers reported multiple **software supply chain-style malware distribution** efforts abusing developer-adjacent platforms. JFrog detailed a malicious npm package, `@openclaw-ai/openclawai`, masquerading as an *OpenClaw* CLI installer; once executed, it uses a `postinstall` hook to reinstall globally and drop an obfuscated first-stage (`setup.js`) that deploys a multi-stage payload internally identified as **GhostLoader** (campaign tracked as **GhostClaw**). The malware is designed to persist and exfiltrate a broad set of sensitive data from developer workstations, including credentials (e.g., cloud config artifacts for **AWS/GCP/Azure**), macOS Keychain data, browser sessions, SSH keys, and cryptocurrency wallet/seed material. Separately, Trend Micro reported a large-scale distribution operation for the **BoryptGrab** information stealer via **100+ public GitHub repositories** that pose as legitimate tools and game cheats. The campaign uses SEO manipulation (keyword-stuffed READMEs and lookalike download pages) to drive victims from search results into redirect chains that ultimately deliver ZIP archives containing the stealer; some variants also deploy a PyInstaller backdoor (**TunnesshClient**) that establishes a reverse SSH tunnel for attacker communications. Reported indicators (e.g., Russian-language comments and related infrastructure) suggest a possible Russian nexus, and the observed targeting focuses on harvesting browser data, crypto wallets, system information, and user files.
Jun 29, 2026