--- id: "CMP-202611-3fppub" page: "https://infrastack.ai/live/CMP-202611-3fppub" kind: "campaign" aliases: [] title: "Fake security tools and game cheats on GitHub run hidden PowerShell when you build or run them, installing AsyncRAT, a crypto clipper and an infostealer on Windows (Dr.Web)" severity: "high" cvss: null epss: null exploited: true status: "open" category: "package" products: [{"name": "GitHub", "fixed": [], "vendor": "GitHub"}, {"name": "Visual Studio", "fixed": [], "vendor": "Microsoft"}, {"name": "Windows", "fixed": [], "vendor": "Microsoft"}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-06T19:25:09+00:00" updated_at: "2026-11-06T19:25:37+00:00" sources: [{"source": "analyst", "url": "https://news.drweb.com/show/?i=15311&lng=en", "first_seen_at": "2026-11-06T19:25:09+00:00", "cites": ["https://news.drweb.com/show/?i=15311&lng=en"]}] exploit_sources: [] --- # Operation Muck and Load: Fake security tools and game cheats on GitHub run hidden PowerShell when you build or run them, installing AsyncRAT, a crypto clipper and an infostealer on Windows (Dr.Web) Link for people: https://infrastack.ai/live/CMP-202611-3fppub (this .md is for agents) Doctor Web reports GitHub repositories that pose as security tools (scan automation, security testing, log analysis, such as a script that parses and formats Fscan scanner output) and, in earlier waves, blockchain game bots and cheats (such as for Catizen). Malicious code sits in Visual Studio projects (a .csproj PreBuildEvent that runs before compilation, PowerShell in .suo files) and in Python and Go files, hidden behind long runs of whitespace. Building or running the project starts PowerShell that pulls an encrypted link from Pastebin, YouTube, Telegram, Google Docs or GitCode, then downloads an Electron loader, Microsoft.exe. The loader disables Defender, UAC, System Restore and VSS, removes ESET, McAfee and Malwarebytes, and injects AsyncRAT (two copies), a clipper that swaps crypto wallet addresses, and a stealer that takes browser data, FileZilla, MobaXterm, Total Commander FTP and VPN settings, game accounts and Discord tokens and sends them out through a Telegram bot. More than 2,000 Windows PCs infected. Active for about two years, with the move to security-tool lures recent. The muck* domains and Microsoft.exe match Socket's 'Operation Muck and Load' report from July 2026 (222 lure repositories). _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - :GitHub affected range not listed fixed no fixed version listed - :Visual Studio affected range not listed fixed no fixed version listed - :Windows affected range not listed fixed no fixed version listed ## How to check - Before building or running a cloned GitHub project, look in .csproj files for PreBuildEvent commands, in .suo files for PowerShell, and in .py/.go files for code pushed far to the right behind long runs of whitespace. - Network: connections to muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com, muckdeveloper[.]com or 130.12.182[.]172; unexpected Telegram bot API traffic. - On disk: C:\Users\Public\Pictures\t.ps1 or L.ps1; folder C:\ProgramData\Windows.Microsoft.Photos with Microsoft.exe; archives Quixo.7z, Nexara.7z, Nvdia.7z, Lodge.7z; files boot_f, kernel_f, thread_f, thumbcache_*.dll; WUDFHost.exe outside System32. - System: Defender exclusions for regasm.exe and dwm.exe, Smart App Control turned off (VerifiedAndReputablePolicyState changed), System Restore/VSS disabled, ESET/McAfee/Malwarebytes removed, a changed hosts file blocking antivirus domains, files missing from System32\drivers\etc. - Detections: Dr.Web names Trojan.Loader.3261, PowerShell.Packed.270, BackDoor.AsyncRAT.115, Trojan.InjectNET.14, Trojan.Clipper.688, JS.Stealer.191. Specific repository names: unknown (Dr.Web shows an Fscan output parser and Catizen bot projects). ## Fix - Don't build or run security tools, game bots or cheats from unknown GitHub accounts on your work machine. Read the build files first, or use a throwaway VM. - If you find the indicators: isolate the PC, reinstall Windows (the malware disables recovery and removes antivirus), then from a clean device change every password and session saved in browsers, FileZilla, MobaXterm, Total Commander, VPN clients and Discord. - Treat crypto wallets on the machine as exposed: move funds to a new wallet, and check any address you pasted against the one you meant to use. - Block the muck* domains and 130.12.182[.]172 at DNS and firewall. ## Timeline - 2026-11-06T19:25:09+00:00 analyst https://news.drweb.com/show/?i=15311&lng=en ## Documents - [describes] @BleepinComputer: Fake security tools on GitHub push backdoors and infostealers https://t.co/rSx4m https://x.com/BleepinComputer/status/2118777215710068912 - [describes] BleepingComputer: Fake security tools on GitHub push backdoors and infostealers https://www.bleepingcomputer.com/news/security/fake-security-tools-on-github-push-backdoors-and-infostealers/ - [describes] Doctor Web: Threat actors target information security developers on GitHub https://news.drweb.com/show/?i=15311&lng=en --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_