Fake GitHub security tools are dropping a backdoor, a clipper and a stealer

Security researchers at Dr.Web say people who clone or build certain GitHub projects are installing more than a sample tool. Hidden code in those repositories leads to a backdoor, a clipper that swaps cryptocurrency addresses, and a program that steals saved logins and tokens. When Dr.Web published its report on November 5, 2026, more than 2,000 Windows PCs had been infected.

What the researchers found

In “Insolence beyond belief,” Dr.Web describes a campaign that has been placing malicious repositories on GitHub for about two years. The early projects targeted people interested in blockchain games, bots and cheat tools. The operators have since shifted toward information-security work: scanning automation, security testing and log analysis.

One example they give is a repository advertised as a lightweight script to parse, clean and format output from the Fscan network scanner. The malicious parts are not sitting in an obvious “malware.exe” in the folder. Dr.Web found them in Visual Studio project files (including a pre-build step that runs before the project is compiled, and in .suo files), and in Python and Go source files, hidden behind long stretches of whitespace.

BleepingComputer’s November 6 report summarises the same chain. A PowerShell script retrieves an encrypted download link. That link leads to an Electron-based loader named Microsoft.exe, which Dr.Web tracks as Trojan.Loader.3261. The loader sets itself to start again after a reboot, tries to raise its privileges, turns off several Windows security and recovery features, and then plants the next stage inside legitimate Windows processes.

Dr.Web says the final payloads are:

• The AsyncRAT backdoor, in two copies that use different network ports, so more than one operator can control the same PC.
• A clipper that replaces cryptocurrency wallet addresses copied to the clipboard, and sends screenshots and other details to the attackers through Telegram.
• An information stealer that collects browser data, FileZilla and other FTP settings, VPN settings, messenger files, game-account data and Discord tokens, then sends the bundle through a Telegram bot.

The malware also tries to remove ESET, McAfee and Malwarebytes if they are installed, and it edits the Windows hosts file so some antivirus update sites no longer resolve. Dr.Web lists several internet addresses tied to the bogus repositories, and it describes unused code that looks like a future persistence service. Those details are in the report if you are investigating an infection. They are not needed to stay clear of the lure.

What this means for you

This campaign is aimed at people who download developer or security tools from GitHub and run or compile them. A repository that looks like a helper for a scanner you already use is harder to dismiss than an obvious crack or cheat. If you do not build tools from public repositories, this is not something that arrives through a normal website visit.

If a machine is already infected, a stolen browser session or Discord token can matter as much as a stolen password. See how infostealers steal your sessions, and why a new password isn’t enough.

What you can do

1. Do not compile or run an unaudited GitHub project that appeared as a convenient scanner helper, log parser or security test kit, especially if you found it through a search or an unofficial link.
2. If you already built or ran a project like that, treat the PC as compromised. Use a clean device to change passwords, revoke Discord and other tokens, and sign out other sessions. Check cryptocurrency wallets for any address that was swapped in the clipboard.
3. On a machine you still trust, look at Visual Studio pre-build events and at Python or Go files for huge blocks of blank space hiding extra code, which is the hiding trick Dr.Web describes. When in doubt, delete the project and keep working from a known-good copy.
4. Prefer tools you get from the author’s official site or a package source you already trust, not a lookalike repository with extra “helper” scripts.

How Frame helps

This one is about a program running on a PC, not a published list of customer emails. The checks above are the useful part. If a later notice names leaked account addresses, Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.

Related coverage

• How infostealers steal your sessions, and why a new password isn’t enough: why signing out everywhere matters after a stealer, not only changing the password.
• OVHcloud CLI downloads were swapped for a secret-stealer: another case of a tool administrators thought they could trust delivering something else.

Sources

• Dr.Web, Insolence beyond belief. Threat actors target information security developers on GitHub, November 5, 2026
• BleepingComputer, Fake security tools on GitHub push backdoors and infostealers, November 6, 2026