Researchers at the cybersecurity firm Dr. Web have uncovered a malware campaign targeting cybersecurity professionals via booby-trapped software repositories on the GitHub platform. This campaign relies on distributing software projects that appear to be useful security tools, such as scanning automation, penetration testing, and log analysis tools, but in reality, they install backdoors and information-stealing malware.
Evolution of Victim Targeting and Evasion Mechanisms
This campaign began about two years ago, initially focusing on cryptocurrency wallet users, but the attackers recently shifted their strategy to target technical professionals. More than 2,000 Windows-based systems have been observed to be infected so far.
The campaign uses traditional yet effective evasion techniques, where malicious code is embedded within Visual Studio project files, Python scripts, and Go source files. The code is hidden behind long whitespace to avoid detection. In some Visual Studio projects, the "pre-build event" routine is exploited to automatically execute the malicious code before the program compilation process.
Infection Chain and Advanced Evasion Techniques
The infection process begins by using PowerShell to fetch an encrypted download link, which in turn downloads a loader based on the Electron framework with the misleading name 'Microsoft.exe'. This loader works to establish its presence in the system, escalate its privileges, disable Windows security and recovery features, and then inject malware into legitimate system processes.
The researchers explained that the loader uses two operating modes to bypass defenses:
- Mode 3: This is the default mode, and it uses six advanced evasion techniques, including making the explorer.exe process appear as the parent process of the malicious file, disabling Smart App Control, and modifying memory to disable Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW).
- Mode 2: This is used if the first mode fails, and it relies on adding exclusions to Microsoft Defender and using a PowerShell script to inject the payload into the RegAsm.exe process.
Final Objectives: Data Theft and Full Control
Once the injection process is successful, final payloads are sent, including:
- AsyncRAT: A backdoor that gives attackers full control over the device.
- Clipper Malware: Software that replaces cryptocurrency wallet addresses in the clipboard with addresses owned by the attacker.
- Infostealer: Data-stealing software that collects browser information, VPN settings, FTP client configuration files, gaming account data, and Discord tokens, then sends them via a Telegram bot.
Furthermore, the malware attempts to remove popular security software such as ESET, McAfee, and Malwarebytes, and disables Windows backup processes.
What Matters to Professionals?
This development represents a dangerous shift in attacker behavior; instead of targeting the average user, attackers are now targeting the "work tools" that security experts themselves rely on. Using technically trusted GitHub repositories as a cover means that trust in open-source tools must remain conditional on careful inspection, especially when dealing with projects containing build files or automation scripts from unknown sources.