Fake security tools on GitHub push backdoors and infostealers

Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware.

The campaign started about two years ago and initially targeted crypto wallet users, but recently the threat actor switched focus and published malicious repositories for automating scans, security testing, and log analysis.

Researchers at cybersecurity company Dr. Web found that more than 2,000 Windows systems have been compromised so far.

One malicious repository they found is a fake script advertised as a lightweight solution to parse, clean, and format output from the Fscan network scanner.

Previous lures included blockchain games, bots, and cheat tools, typically targeting blockchain and game enthusiasts.

Dr. Web's investigation found malicious code embedded in Visual Studio project files, Python scripts, and Go source files, hidden behind long stretches of whitespace, an old technique that still proves effective.