Attackers Hide AsyncRAT and Infostealers Inside Fake Security Tools on GitHub
Executive Summary
Executive Summary Beginning approximately two years ago and escalating through November 2026, an unattributed threat actor published malicious repositories on GitHub masquerading as legitimate security and developer tools—including Fscan parsers, scan automation scripts, and log analyzers—to target cybersecurity professionals. Malicious code was concealed inside Visual Studio project files, Python scripts, and Go source files using whitespace obfuscation. A modular Electron-based loader named Microsoft.exe established persistence, disabled Windows defenses including AMSI and ETW, and injected final payloads: AsyncRAT, clipboard-hijacking clipper malware, and a credential infostealer that exfiltrated browser data, VPN configs, FTP credentials, Discord tokens, and gaming account data via Telegram. Over 2,000 Windows systems were confirmed compromised.
This campaign reflects an accelerating trend of supply-chain and developer-trust abuse, where attackers embed malware directly inside tools that security practitioners use daily. As open-source tooling becomes a default part of security workflows, poisoned repositories represent a high-leverage, low-detection initial access vector that bypasses traditional perimeter defenses and exploits implicit trust in code-sharing platforms.
Why This Matters Now
Why This Matters NowThreat actors are increasingly targeting security professionals and developers through GitHub-hosted fake tools, exploiting the implicit trust placed in open-source repositories. With AsyncRAT backdoors and infostealers now delivered via weaponized security utilities, organizations face credential theft, persistent remote access, and disabled endpoint defenses—all from within trusted development pipelines. Regulatory frameworks and cloud security postures are not yet fully adapted to mitigate supply-chain-level initial compromise at the developer toolchain layer.
Attack Path Analysis
Attack Path AnalysisAttackers published trojanized security tool repositories on GitHub targeting cybersecurity professionals, embedding malicious code in Visual Studio project files, Python scripts, and Go source files hidden behind whitespace. Once cloned and executed, a PowerShell-based infection chain fetched an encrypted Electron-based loader ('Microsoft.exe') that established persistence, escalated privileges, disabled Windows defenses, and injected AsyncRAT, clipboard-hijacking malware, and an infostealer into legitimate processes. The infostealer exfiltrated credentials, browser data, VPN configs, and tokens via Telegram bots, while the backdoor maintained long-term access; antivirus tools were actively removed and Windows backups were destroyed to maximize impact and impede recovery.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionThreat actor published malicious GitHub repositories masquerading as legitimate security tools (Fscan parsers, log analyzers, automation scripts). Cybersecurity professionals cloned and executed these repositories, triggering malicious code embedded in Visual Studio pre-build events, Python scripts, and Go source files concealed via whitespace obfuscation. PowerShell was used to retrieve an encrypted download link fetching the next-stage loader.
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesSupply Chain Compromise: Compromise Software Dependencies and Development Tools
Obfuscated Files or Information: HTML Smuggling / Whitespace Steganography
Command and Scripting Interpreter: PowerShell
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Impair Defenses: Disable or Modify Tools
Process Injection
Exfiltration Over C2 Channel
Screen Capture / Credential and Browser Data Harvesting (Infostealer)
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Malicious Code Protection / Software Integrity / Supply Chain Risk Management
Control ID: SI-3, SI-7, SA-12
CISA Zero Trust Maturity Model 2.0 – Endpoint Integrity Verification and Application Allow-listing
Control ID: Application Pillar – Visibility & Analytics / Device Pillar – Device Compliance
NIS2 Directive – Supply Chain Security and Incident Handling Obligations
Control ID: Article 21 – Security of Network and Information Systems
PCI DSS 4.0 – Anti-Malware Controls / Vulnerability Management / Cryptographic Inventory
Control ID: Requirement 5.2, 6.3.3, 12.3.3
NYDFS 23 NYCRR 500 – Third-Party Risk and Continuous Monitoring
Control ID: Section 500.14 – Monitoring; Section 500.9 – Risk Assessment
DORA (EU Digital Operational Resilience Act) – Third-Party ICT Risk Management and Incident Detection Capability
Control ID: Article 28 – ICT Third-Party Risk; Article 10 – ICT-Related Incident Detection
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer/Network Security
Security professionals downloading fake GitHub scanning and log-analysis tools risk AsyncRAT backdoor and infostealer compromise, with AMSI/ETW patching and AV removal undermining zero-trust and egress enforcement controls.
Computer Software/Engineering
Developers using trojanized Visual Studio projects and Python/Go source files face supply-chain backdoor injection, with pre-build execution evading NIST.800-53.SI-4 inline IPS and cloud firewall egress controls.
Financial Services
Clipboard-hijacking clipper malware and VPN credential theft via Telegram exfiltration directly threaten PCI.4.0 and NIST.CSF.PR.DS-5 compliance, enabling fraudulent crypto and financial account takeover.
Information Technology/IT
IT teams leveraging GitHub automation tooling face persistent loader malware disabling Windows recovery and security, demanding ZTMM lateral-movement segmentation and multicloud C2 visibility controls per NIST.800-53.AU-6.
Sources
Sources- Fake security tools on GitHub push backdoors and infostealershttps://www.bleepingcomputer.com/news/security/fake-security-tools-on-github-push-backdoors-and-infostealers/Verified
- Dr. Web Malware Analysis: Trojan.Loader.3261 Campaignhttps://news.drweb.com/show/?i=15311&lng=en&c=5Verified
- Dr. Web Malware IOCs: Trojan.Loader.3261https://github.com/DoctorWebLtd/malware-iocs/blob/master/Trojan.Loader.3261/README.adocVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Fake LastPass Authenticator GitHub repos push new Rapuncel infostealerhttps://www.bleepingcomputer.com/news/security/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer/Verified
- OVHcloud CLI releases backdoored on GitHub to steal developer secretshttps://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/Verified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant here because the attacker relied on unrestricted outbound access from developer workstations and uncontrolled east-west paths to pivot into broader cloud and internal environments. By enforcing workload-level segmentation and identity-aware egress controls, CNSF would likely have reduced the attacker's ability to reach internal systems and exfiltrate harvested data undetected.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Outbound connections from developer workstations to unrecognized external hosts used for staging payload delivery could likely be constrained, reducing the attacker's ability to successfully retrieve the encrypted loader after initial code execution.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the scope of what a privilege-escalated process could reach across the environment, limiting lateral reachability even after the local host was compromised.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely limit the attacker's ability to move laterally from the compromised workstation into adjacent cloud workloads or internal segments, reducing the overall reach of injected payloads running under spoofed process identities.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility could help surface anomalous outbound sessions to Telegram infrastructure from workloads where such traffic is not an expected or policy-approved destination, potentially reducing the attacker's ability to maintain reliable C2 communication.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement would likely reduce the attacker's ability to silently exfiltrate harvested credentials and tokens over HTTPS to Telegram, constraining outbound data paths to only policy-approved destinations from sensitive workload environments.
Even with local defenses degraded, the attacker's ability to convert stolen credentials and VPN configs into broader cloud environment access would likely remain constrained by segmentation boundaries already enforced at the network fabric layer.
Impact at a Glance
Affected Business Functions
- Security Operations and Penetration Testing Workflows
- Developer Source Code Integrity and CI/CD Pipelines
- Cryptocurrency Wallet and Financial Transaction Management
- Endpoint Security and Antivirus Defense Posture
Estimated downtime: 7 days
Estimated loss: N/A
Over 2,000 Windows systems compromised primarily targeting cybersecurity professionals and developers. Exposed data categories include: browser-stored credentials and session tokens, VPN client configuration files and credentials, FTP client credentials and server configurations, gaming platform account credentials, Discord authentication tokens, cryptocurrency wallet addresses (subject to clipboard hijacking and address substitution), and sensitive security tooling output. Exfiltration channel confirmed via Telegram bot. Threat actor also attempted removal of ESET, McAfee, and Malwarebytes endpoint protection and disrupted Windows backup and recovery mechanisms, increasing risk of persistent access and unrecoverable compromise. The targeting of security professionals introduces elevated risk of secondary downstream compromise of client environments and internal security tooling.
Recommended Actions
Key Takeaways & Next Steps
- • Apply CNSF Cloud Native Security Fabric inline enforcement and egress policy controls (ZTMM.CrossCutting.Automation, NIST.800-53.SI-4) to detect and block anomalous outbound connections to Telegram bots and unauthorized HTTPS destinations used for C2 and exfiltration, preventing data from leaving the environment even after host compromise.
- • Deploy Egress Security & Policy Enforcement (FQDN filtering, egress firewall) aligned with ZTMM.Data and NIST.CSF.PR.DS-5 to restrict developer workstation outbound traffic to approved destinations only, blocking the infostealer's Telegram-based exfiltration channel at the network boundary.
- • Enforce Zero Trust Segmentation and microsegmentation (ZTMM.Network, NIST.800-53.AC-6) on developer endpoints and CI/CD pipeline environments to apply least-privilege identity-based policies, limiting the blast radius of injected processes (RegAsm.exe, explorer.exe) from reaching internal cloud workloads or sensitive network segments.
- • Enable Multicloud Visibility & Control with centralized traffic observability (ZTMM.CrossCutting.Visibility, NIST.800-53.AU-6) to baseline normal developer workstation and build pipeline behavior, generating alerts on anomalous outbound connections, unexpected process network activity, and encrypted traffic to uncategorized or newly registered domains associated with C2 infrastructure.
- • Leverage Inline IPS (Suricata) with updated threat signatures (NIST.800-53.SI-4, PCI.4.0.6.4.1) on egress paths to detect and block known AsyncRAT communication patterns, malicious payload delivery signatures, and clipboard-hijacking indicators, while pairing with East-West Traffic Security controls (ZTMM.Network, NIST.CSF.DE.CM-1) to detect any lateral movement attempts from compromised developer systems toward internal cloud workloads.
