{"id":"CMP-202611-3fppub","kind":"campaign","aliases":[],"related":[],"title":"Fake security tools and game cheats on GitHub run hidden PowerShell when you build or run them, installing AsyncRAT, a crypto clipper and an infostealer on Windows (Dr.Web)","description":null,"summary":"Doctor Web reports GitHub repositories that pose as security tools (scan automation, security testing, log analysis, such as a script that parses and formats Fscan scanner output) and, in earlier waves, blockchain game bots and cheats (such as for Catizen). Malicious code sits in Visual Studio projects (a .csproj PreBuildEvent that runs before compilation, PowerShell in .suo files) and in Python and Go files, hidden behind long runs of whitespace. Building or running the project starts PowerShell that pulls an encrypted link from Pastebin, YouTube, Telegram, Google Docs or GitCode, then downloads an Electron loader, Microsoft.exe. The loader disables Defender, UAC, System Restore and VSS, removes ESET, McAfee and Malwarebytes, and injects AsyncRAT (two copies), a clipper that swaps crypto wallet addresses, and a stealer that takes browser data, FileZilla, MobaXterm, Total Commander FTP and VPN settings, game accounts and Discord tokens and sends them out through a Telegram bot. More than 2,000 Windows PCs infected. Active for about two years, with the move to security-tool lures recent. The muck* domains and Microsoft.exe match Socket's 'Operation Muck and Load' report from July 2026 (222 lure repositories).","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-06T19:25:09+00:00","products":[{"name":"GitHub","fixed":[],"vendor":"GitHub"},{"name":"Visual Studio","fixed":[],"vendor":"Microsoft"},{"name":"Windows","fixed":[],"vendor":"Microsoft"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- Before building or running a cloned GitHub project, look in .csproj files for PreBuildEvent commands, in .suo files for PowerShell, and in .py/.go files for code pushed far to the right behind long runs of whitespace.\n- Network: connections to muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com, muckdeveloper[.]com or 130.12.182[.]172; unexpected Telegram bot API traffic.\n- On disk: C:\\Users\\Public\\Pictures\\t.ps1 or L.ps1; folder C:\\ProgramData\\Windows.Microsoft.Photos with Microsoft.exe; archives Quixo.7z, Nexara.7z, Nvdia.7z, Lodge.7z; files boot_f, kernel_f, thread_f, thumbcache_*.dll; WUDFHost.exe outside System32.\n- System: Defender exclusions for regasm.exe and dwm.exe, Smart App Control turned off (VerifiedAndReputablePolicyState changed), System Restore/VSS disabled, ESET/McAfee/Malwarebytes removed, a changed hosts file blocking antivirus domains, files missing from System32\\drivers\\etc.\n- Detections: Dr.Web names Trojan.Loader.3261, PowerShell.Packed.270, BackDoor.AsyncRAT.115, Trojan.InjectNET.14, Trojan.Clipper.688, JS.Stealer.191. Specific repository names: unknown (Dr.Web shows an Fscan output parser and Catizen bot projects).","fix":"- Don't build or run security tools, game bots or cheats from unknown GitHub accounts on your work machine. Read the build files first, or use a throwaway VM.\n- If you find the indicators: isolate the PC, reinstall Windows (the malware disables recovery and removes antivirus), then from a clean device change every password and session saved in browsers, FileZilla, MobaXterm, Total Commander, VPN clients and Discord.\n- Treat crypto wallets on the machine as exposed: move funds to a new wallet, and check any address you pasted against the one you meant to use.\n- Block the muck* domains and 130.12.182[.]172 at DNS and firewall.","status":"open","published_at":null,"first_seen_at":"2026-11-06T19:25:09+00:00","triaged_at":"2026-11-06T19:25:09+00:00","updated_at":"2026-11-06T19:25:37+00:00","category":"package","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':30A '-3':31A '000':194B '2':193B '2026':227B '222':228B 'account':179B 'activ':198B 'address':162B 'analysi':56B 'asyncrat':19A,153B 'autom':52B 'behind':106B 'blockchain':72B 'bot':74B,190B 'browser':168B 'build':14A,111B 'campaign':37B 'catizen':80B 'cheat':6A,76B 'clipper':22A,157B 'cmp':29A 'code':82B 'command':173B 'compil':94B 'copi':155B 'crypto':21A,160B 'csproj':89B 'data':169B 'defend':140B 'disabl':139B 'discord':181B 'doc':128B 'doctor':41B 'domain':214B 'download':132B 'dr.web':28A 'earli':39B 'earlier':70B 'early-warn':38B 'electron':134B 'encrypt':121B 'eset':147B 'fake':1A 'file':98B,104B 'filezilla':170B 'format':64B 'fppub':32A 'fscan':65B 'ftp':174B 'game':5A,73B,178B 'gitcod':130B 'github':8A,33A,44B 'go':103B 'googl':127B 'hidden':10A,105B 'infect':197B 'infosteal':25A 'inject':152B 'instal':18A 'juli':226B 'link':122B 'load':223B 'loader':135B,138B 'log':55B 'long':107B 'lure':210B,229B 'malici':81B 'malwarebyt':150B 'match':217B 'mcafe':148B 'microsoft.exe':136B,216B 'mobaxterm':171B 'move':205B 'muck':213B,221B 'oper':220B 'output':67B 'pars':62B 'pastebin':124B 'pcs':196B 'pose':47B 'powershel':11A,95B,117B 'prebuildev':90B 'project':87B,115B 'pull':119B 'python':101B 'recent':211B 'remov':146B 'report':43B,224B 'repositori':45B,230B 'restor':143B 'run':9A,16A,92B,108B,113B 'scan':51B 'scanner':66B 'script':60B 'secur':2A,49B,53B,208B 'security-tool':207B 'send':184B 'set':177B 'sit':83B 'socket':218B 'start':116B 'stealer':165B 'studio':35A,86B 'suo':97B 'swap':159B 'system':142B 'take':167B 'telegram':126B,189B 'test':54B 'token':182B 'tool':3A,50B,209B 'total':172B 'two':154B,201B 'uac':141B 'visual':34A,85B 'vpn':176B 'vss':145B 'wallet':161B 'warn':40B 'wave':71B 'web':42B 'whitespac':110B 'window':27A,195B 'windows':36A 'year':202B 'youtub':125B","nicknames":["Operation Muck and Load"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["github","operationmuckandload","studio","visualstudio","windows"],"ptokens":["github","studio","visual","windows"],"labels":["campaign","earlywarning","high","package"],"campaign_type":"malware","search_a":"'-202611':30A '-3':31A 'asyncrat':19A 'build':14A 'cheat':6A 'clipper':22A 'cmp':29A 'crypto':21A 'dr.web':28A 'fake':1A 'fppub':32A 'game':5A 'github':8A,33A 'hidden':10A 'infosteal':25A 'instal':18A 'powershel':11A 'run':9A,16A 'secur':2A 'studio':35A 'tool':3A 'visual':34A 'window':27A 'windows':36A","search_b":"'000':194B '2':193B '2026':227B '222':228B 'account':179B 'activ':198B 'address':162B 'analysi':56B 'asyncrat':153B 'autom':52B 'behind':106B 'blockchain':72B 'bot':74B,190B 'browser':168B 'build':111B 'campaign':37B 'catizen':80B 'cheat':76B 'clipper':157B 'code':82B 'command':173B 'compil':94B 'copi':155B 'crypto':160B 'csproj':89B 'data':169B 'defend':140B 'disabl':139B 'discord':181B 'doc':128B 'doctor':41B 'domain':214B 'download':132B 'earli':39B 'earlier':70B 'early-warn':38B 'electron':134B 'encrypt':121B 'eset':147B 'file':98B,104B 'filezilla':170B 'format':64B 'fscan':65B 'ftp':174B 'game':73B,178B 'gitcod':130B 'github':44B 'go':103B 'googl':127B 'hidden':105B 'infect':197B 'inject':152B 'juli':226B 'link':122B 'load':223B 'loader':135B,138B 'log':55B 'long':107B 'lure':210B,229B 'malici':81B 'malwarebyt':150B 'match':217B 'mcafe':148B 'microsoft.exe':136B,216B 'mobaxterm':171B 'move':205B 'muck':213B,221B 'oper':220B 'output':67B 'pars':62B 'pastebin':124B 'pcs':196B 'pose':47B 'powershel':95B,117B 'prebuildev':90B 'project':87B,115B 'pull':119B 'python':101B 'recent':211B 'remov':146B 'report':43B,224B 'repositori':45B,230B 'restor':143B 'run':92B,108B,113B 'scan':51B 'scanner':66B 'script':60B 'secur':49B,53B,208B 'security-tool':207B 'send':184B 'set':177B 'sit':83B 'socket':218B 'start':116B 'stealer':165B 'studio':86B 'suo':97B 'swap':159B 'system':142B 'take':167B 'telegram':126B,189B 'test':54B 'token':182B 'tool':50B,209B 'total':172B 'two':154B,201B 'uac':141B 'visual':85B 'vpn':176B 'vss':145B 'wallet':161B 'warn':40B 'wave':71B 'web':42B 'whitespac':110B 'window':195B 'year':202B 'youtub':125B","search_c":"","first_public_at":"2026-11-05T04:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-3fppub","url":"https://news.drweb.com/show/?i=15311&lng=en","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-06T19:25:09+00:00","fetched_at":"2026-11-06T19:25:09+00:00","note":null,"cites":["https://news.drweb.com/show/?i=15311&lng=en"]}],"documents":[{"id":88877,"url":"https://x.com/BleepinComputer/status/2118777215710068912","title":"@BleepinComputer: Fake security tools on GitHub push backdoors and infostealers\nhttps://t.co/rSx4m","kind":"post","source":"x","publisher":null,"text":"Fake security tools on GitHub push backdoors and infostealers\nhttps://t.co/rSx4mNIDzz\n\nhttps://t.co/rSx4mNIDzz\n\nlikes 14 reposts 4","published_at":"2026-11-06T18:47:07+00:00","relation":"describes","confidence":null,"note":null},{"id":88977,"url":"https://www.bleepingcomputer.com/news/security/fake-security-tools-on-github-push-backdoors-and-infostealers/","title":"BleepingComputer: Fake security tools on GitHub push backdoors and infostealers","kind":"blog","source":"blog","publisher":null,"text":"Fake security tools on GitHub push backdoors and infostealers\n\nCybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. [...]","published_at":"2026-11-06T18:46:52+00:00","relation":"describes","confidence":null,"note":null},{"id":89108,"url":"https://news.drweb.com/show/?i=15311&lng=en","title":"Doctor Web: Threat actors target information security developers on GitHub","kind":"blog","source":"analyst","publisher":null,"text":"Infected GitHub repositories with Visual Studio projects (.csproj PreBuildEvent, .suo with PowerShell command) and Python/Go files with code hidden behind whitespace. Started ~2 years ago with blockchain game/bot/cheat lures (e.g. Catizen), now fake security tools (scanning automation, security testing, log analysis, e.g. an Fscan output parser). 2,000+ PCs infected. Attacker addresses: muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com, muckdeveloper[.]com, 130.12.182[.]172. PowerShell at C:\\Users\\Public\\Pictures\\t.ps1 / L.ps1 fetches encrypted strings from Pastebin, YouTube, Telegram, Google Docs, GitCode; downloads Quixo.7z to C:\\ProgramData\\Windows.Microsoft.Photos; Electron loader Microsoft.exe (Trojan.Loader.3261, v1.4.5) downloads Nexara.7z, disables Defender, UAC, System Restore, VSS, adds Defender exclusions, injects into RegAsm.exe, dwwin.exe, dwm.exe: AsyncRAT x2, clipper, JS.Stealer.191 (browser data, FileZilla, MobaXterm.ini, Total Commander wcx_ftp.ini, VPN, messengers, game accounts, Discord tokens) exfil via Telegram bot. Removes ESET, McAfee, Malwarebytes; modifies hosts file; deletes files in system32\\drivers\\etc except whitelist. Unfinished Lodge.7z / WUDFHost.exe component.","published_at":"2026-11-05T04:00:00+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}