A long-running supply chain campaign tracked by researchers at Dr. Web has shifted its focus from cryptocurrency users to cybersecurity professionals and developers, utilizing malicious GitHub repositories to distribute backdoors and information stealers, as reported by BleepingComputer. The campaign, active for approximately two years, has successfully compromised more than 2,000 Windows systems by disguising malware as legitimate utilities for network scanning, log analysis, and security testing.
Technical Analysis of the GitHub Infection Vector
The threat actors leverage malicious repositories containing rigged Visual Studio project files, Python scripts, and Go source files. Code execution is often concealed behind long stretches of whitespace or executed via pre-build event routines in Visual Studio before compilation occurs.
The multi-stage infection chain relies on PowerShell to fetch an encrypted download link, which subsequently deploys a modular Electron-based loader named Microsoft.exe. Once active, the loader executes the following actions:
- Establishes system persistence and attempts privilege escalation.
- Disables Windows security features, recovery options, and interferes with system backups.
- Attempts to remove third-party antivirus solutions including ESET, McAfee, and Malwarebytes while blocking connection to their update servers.
- Implements multiple evasion techniques, particularly in its default operational mode, or falls back to secondary execution routines that inject payloads into legitimate binaries such as
RegAsm.exe.
The final payloads delivered to infected hosts include the AsyncRAT backdoor, a cryptocurrency clipper that swaps wallet addresses in the clipboard, and an information stealer designed to harvest browser data, VPN configurations, FTP client data, gaming credentials, and Discord tokens. Exfiltration of sensitive artifacts is handled via Telegram bots.
Defending Against Malicious Developer Repositories
Security teams and development organizations must treat public code repositories with strict scrutiny, particularly when sourcing automation scripts or testing tools. Organizations should establish strict software composition analysis and restrict the execution of unverified pre-build scripts in development pipelines.
Mitigation Steps
- Audit Developer Tooling: Restrict the direct execution of third-party scripts and code projects sourced from unverified GitHub accounts on production and administrative workstations.
- Monitor Endpoint Security: Ensure Windows security features, Defender exclusions, and recovery options are actively monitored for unauthorized modifications.
- Inspect Endpoint Processes: Regularly hunt for anomalous child processes spawned by build tools or unexpected network connections communicating with Telegram bot infrastructure.
Related: New Linux Backdoors Mimic Asian Mail Security Products, CloudSyncD Backdoor Targets macOS Users via Fake Zoom Installer