On GitHub, Fake Security Tools Install Backdoors and Infostealers

On November 6, 2026, Bleeping Computer reported on a campaign targeting cybersecurity professionals. Projects presented as scanning, testing or log-analysis tools are actually installing a backdoor and several malware strains. In other words, the toolbox comes with a few unwelcome extras.

Convincing tools designed to fool specialists

The campaign reportedly began about two years ago, initially targeting cryptocurrency-wallet users. The attackers have recently changed direction and now publish repositories linked to scan automation, security testing and log analysis.

Dr. Web researchers identified, among other things, a fake script presented as a lightweight solution for analysing, cleaning up and formatting output from the Fscan network scanner. More than 2,000 Windows systems have been compromised at this stage, according to their findings as reported by Bleeping Computer.

The malicious code is hidden in Visual Studio project files, Python scripts and Go sources. It lurks behind long sequences of spaces, an old trick that still gets plenty of mileage. In some Visual Studio projects, a pre-compilation routine launches the code directly, before the software has even had time to pretend it is being built normally.

An infection chain built to keep a low profile

The infection starts with PowerShell, which retrieves an encrypted download link. That link leads to an Electron-based modular loader named Microsoft.exe. Once installed, the program establishes persistence, elevates its privileges, disables Windows security and recovery mechanisms, then injects the rest of the infection into legitimate processes.

Its default operating mode, called Mode3 by Dr. Web, combines six evasion techniques. The loader makes explorer.exe appear to be the parent process, modifies the registry to disable Smart App Control and restores the original code of ntdll.dll to remove hooks added by security tools. It also performs direct system calls and alters EtwEventWrite and AmsiScanBuffer in memory, reducing the visibility of telemetry and antivirus inspection of scripts. The malware is essentially turning down the lights before starting the burglary.

If that mode fails, the loader switches to Mode2. It then adds exclusions to Microsoft Defender and uses PowerShell to decrypt and inject the payloads into RegAsm.exe.

Stolen data and multiple payloads

The campaign deploys AsyncRAT, malware capable of providing a backdoor, along with a clipper that replaces cryptocurrency-wallet addresses copied to the clipboard. An infostealer collects browser data, VPN settings, FTP-client configuration files, gaming-account data and Discord tokens. The information is then exfiltrated through a Telegram bot.

The loader also attempts to remove ESET, McAfee and Malwarebytes antivirus products, prevent them from reaching their update servers and interfere with Windows backups. Dr. Web also found a component that appears unfinished, but could keep the loader active and download it again after it has been removed from the disk.

That final detail suggests the malware is still evolving. The researchers have published the complete list of indicators of compromise observed in the campaign. On GitHub, the security-project badge clearly is not a warranty card: it does not guarantee that a project is protecting your machine rather than inspecting it for spare victims.