---
id: "CMP-202611-cyizpm"
page: "https://infrastack.ai/live/CMP-202611-cyizpm"
kind: "campaign"
aliases: []
title: "Malware posing as a 'Dev Toolkit - Background Service' steals developers' GitHub tokens and can spread itself into the victim's GitHub repos; live C2 panels at api.avonlo[.]com and 199.91.221[.]237 (MalwareHunterTeam)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "GitHub", "fixed": [], "ecosystem": "saas"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-10T11:19:36+00:00"
updated_at: "2026-11-10T11:20:30+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-10T11:19:36+00:00"}]
exploit_sources: []
---

# Malware posing as a 'Dev Toolkit - Background Service' steals developers' GitHub tokens and can spread itself into the victim's GitHub repos; live C2 panels at api.avonlo[.]com and 199.91.221[.]237 (MalwareHunterTeam)

Link for people: https://infrastack.ai/live/CMP-202611-cyizpm (this .md is for agents)

MalwareHunterTeam reported on 10 Nov 2026 a malware sample whose code calls itself a 'Dev Toolkit - Background Service' ('Configuration sync and telemetry service') but has C2 and victim handling, steals the victim's GitHub token and has an 'Auto-spread' option that pushes itself into the victim's GitHub repos with that token. Two web panels titled 'C2' were found on port 3000. A related sample was uploaded to MalwareBazaar by @smica83. How it reaches victims (npm or other package, extension, fake repo), the platforms it runs on, and confirmed victims are unknown so far.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- saas:GitHub affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record says the delivery channel and how it reaches victims are unknown so far, and it does not state how the attacker got into any breached organisation, though it describes the token theft and Auto-spread behaviour.

How it reached others: not stated (unknown).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#unknown

## How to check

Network traffic or DNS to api.avonlo[.]com (http://api.avonlo[.]com:3000/) or 199.91.221[.]237 port 3000. A process or service describing itself as 'Dev Toolkit - Background Service' or 'Configuration sync and telemetry service'. In GitHub, commits or new files pushed to your repos that nobody on the team made, and unexpected token use in the GitHub audit log. Delivery channel and file hashes not public yet (sample is on MalwareBazaar via @smica83).

## Fix

Block api.avonlo[.]com and 199.91.221[.]237. If a machine talked to them or runs that 'Dev Toolkit' service: isolate it, revoke and reissue its GitHub tokens (PATs, gh CLI, OAuth) and other credentials on it, and review recent pushes to every repo that account can write to. Turn on branch protection so a stolen token cannot push straight to default branches.

## Timeline

- 2026-11-10T11:19:36+00:00 analyst

## Documents

- [describes] @malwrhunterteam: And @smica83 uploaded a related sample to Bazaar: https://t.co/kb0fTW7bWr https://x.com/malwrhunterteam/status/2120109771848134834
- [describes] @malwrhunterteam: Starts with "Dev Toolkit - Background Service" and "Configuration sync and telem https://x.com/malwrhunterteam/status/2120109623713636783
- [describes] @malwrhunterteam: 🤷‍♂️ https://t.co/VHzmM5Quqf https://x.com/malwrhunterteam/status/2120108684231725278
- [describes] @malwrhunterteam: Some panel simply titled "C2":
http://api.avonlo[.]com:3000/
http://199.91.221[. https://x.com/malwrhunterteam/status/2120108206466925028
- [discussion] @malwrhunterteam: And @smica83 uploaded a related sample to Bazaar: https://t.co/e5N2l78dBS https://x.com/malwrhunterteam/status/2120118359861649442

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_