Malicious GitHub Security Tools Spread AsyncRAT and Infostealers to Over 2,000 PCs

Attackers are distributing malicious GitHub projects disguised as security scanning, testing, and log-analysis tools to compromise cybersecurity professionals. Doctor Web researchers reported more than 2,000 infected Windows systems in a campaign that began roughly two years earlier, initially targeting cryptocurrency users and blockchain-game enthusiasts before expanding to information security developers. Malicious code embedded in Visual Studio project files and Python and Go source files initiates a staged infection chain.

The chain installs an Electron-based loader, detected as Trojan.Loader.3261 and named Microsoft.exe, that establishes persistence, interferes with security controls, and injects payloads into legitimate processes. Delivered malware includes AsyncRAT, a cryptocurrency clipboard hijacker, and an information stealer that exfiltrates data through a Telegram bot. The malware also disables recovery features and attempts to remove antivirus products. Researchers identified an apparently unfinished component intended to keep the loader running and reinstall it if deleted, underscoring the need to vet downloaded development projects and isolate their execution from trusted workstations.