Dr.Web: Fake GitHub Security Tools Infect 2,000 PCs
Attackers hid malware in Visual Studio project files and Python and Go code from repositories posing as network scan and log analysis tools.
Dr.Web published a technical analysis report on November 5 detailing malware distributed through malicious development projects hosted on GitHub. According to the Russian security company, the campaign has infected more than 2,000 Windows PCs.
The attackers disguised the projects as security utilities, including network scan automation, security system testing and log analysis tools. One fake repository presented itself as a tool for formatting and visualizing the output of the network scanner Fscan. The projects came with instructions on installing Visual Studio and cloning the repository, so users would compile and run the malicious code themselves.
The malicious code was hidden in Visual Studio project files (.csproj and .suo) and in Python and Go source code. Some projects abused the PreBuildEvent feature so that malicious commands run before compilation, while Python and Go files concealed code after long runs of whitespace to evade review.
A PowerShell script downloads an archive that installs a program named Microsoft.exe, classified as Trojan.Loader.3261. The loader is Electron-based, and its latest version at analysis time was 1.4.5. It disables Windows Defender, UAC, System Restore and the Volume Shadow Copy Service, and uses parent process masquerading, unhooking and the disabling of ETW and AMSI to avoid detection.
The infection installs two AsyncRAT backdoors on different network ports, reportedly so two attackers can control the same device. Trojan.Clipper.688 replaces copied cryptocurrency wallet addresses with addresses chosen by the attacker, while JS.Stealer.191 collects browser data, VPN settings and FTP credentials from FileZilla, MobaXterm and Total Commander, along with Discord tokens, messenger files and game account information. The stolen data is compressed and sent to the attacker through a Telegram bot.
The malware also attempts to remove security products including ESET, McAfee and Malwarebytes and blocks access to security vendors' servers. Dr.Web said the more than 2,000 infected PCs were counted across the whole campaign, not only from the recently found fake security tools, and did not disclose the country distribution of infections or whether any damage was recorded in Korea.
Quick answers
How many PCs were infected in the GitHub malware campaign?
Dr.Web reported more than 2,000 infected Windows PCs across the whole campaign.
What malware does the fake GitHub tool install?
It installs the Electron-based loader Trojan.Loader.3261, two AsyncRAT backdoors, the cryptocurrency clipper Trojan.Clipper.688 and the information stealer JS.Stealer.191.
Did Dr.Web say how many infections were in Korea?
No. Dr.Web did not disclose the country distribution of infected PCs or whether there was damage in Korea.