Operation Muck and Load: Fake security tools and game cheats on GitHub run hidden PowerShell when you build or run them, installing AsyncRAT, a crypto clipper and an infostealer on Windows (Dr.Web)

Doctor Web reports GitHub repositories that pose as security tools (scan automation, security testing, log analysis, such as a script that parses and formats Fscan scanner output) and, in earlier waves, blockchain game bots and cheats (such as for Catizen). Malicious code sits in Visual Studio projects (a .csproj PreBuildEvent that runs before compilation, PowerShell in .suo files) and in Python and Go files, hidden behind long runs of whitespace. Building or running the project starts PowerShell that pulls an encrypted link from Pastebin, YouTube, Telegram, Google Docs or GitCode, then downloads an Electron loader, Microsoft.exe. The loader disables Defender, UAC, System Restore and VSS, removes ESET, McAfee and Malwarebytes, and injects AsyncRAT (two copies), a clipper that swaps crypto wallet addresses, and a stealer that takes browser data, FileZilla, MobaXterm, Total Commander FTP and VPN settings, game accounts and Discord tokens and sends them out through a Telegram bot. More than 2,000 Windows PCs infected. Active for about two years, with the move to security-tool lures recent. The muck* domains and Microsoft.exe match Socket's 'Operation Muck and Load' report from July 2026 (222 lure repositories).