Supply chain

Doctor Web has published research on a GitHub campaign that plants malware in repositories posing as security tools: scan automation, security testing and log analysis projects. One example was a script sold as a lightweight way to parse, clean and format output from Fscan, a popular open source network scanner. The legitimate Fscan project is not involved; only its name is used as bait. At the time of the research, more than 2,000 Windows machines were infected.

If anyone on your team clones tools from GitHub and opens or builds them in Visual Studio on a work laptop, this applies to you. The infection starts when the project is built, before a single line of the tool itself runs. Penetration testers, SOC analysts and admins who keep local admin rights and a pile of saved credentials are exactly the people this campaign is after.

How it works

A Visual Studio C# project file (.csproj) is an MSBuild script, not just a list of source files. It can contain a PreBuildEvent, a shell command that MSBuild runs before compiling anything. Pressing Build, or running dotnet build or msbuild in a terminal, executes that command with the user's rights. In these repositories the pre-build event launches malicious code. The .suo file, a binary file that stores per-user Visual Studio solution options and is rarely checked into a real project, carried a PowerShell command too.

The Python and Go variants rely on a cheaper trick. The malicious statement sits at the end of an ordinary line, pushed far to the right by a long run of spaces. On GitHub's web view or in an editor without word wrap the line looks empty or harmless, so a quick read of the source misses it.

Whichever way it starts, the first stage is a PowerShell script that Dr.Web detects as PowerShell.Packed.270, dropped as C:\Users\Public\Pictures\t.ps1 and L.ps1. It reaches out to legitimate services, including YouTube, Telegram, Google Docs, GitCode and Pastebin, to fetch an encrypted string that decrypts to a download link. Hosting the pointer on popular sites keeps the repository itself free of an obvious malicious URL and lets the operators change the payload location at will.

The link leads to an archive called Quixo.7z, unpacked into C:\ProgramData\Windows.Microsoft.Photos. Inside is Microsoft.exe, an Electron application (a desktop app built on Chromium and Node.js), version 1.4.5 at the time of writing. Dr.Web calls it Trojan.Loader.3261. Despite the name it has nothing to do with Windows. It pulls further modules from Nexara.7z, collects system information, sets up persistence and tries to escalate privileges.

What the loader does to stay hidden

Before it drops payloads, the loader works to blind endpoint security:

• Parent process ID spoofing, so its children appear to be started by explorer.exe.
• Restoring the original ntdll.dll code from disk, which removes the hooks security products place in that library to watch API calls.
• Direct system calls, resolved with the Halo's Gate technique, which call the kernel without passing through those hooks at all.
• Patching EtwEventWrite so Event Tracing for Windows stops reporting, and patching AmsiScanBuffer so the Antimalware Scan Interface no longer inspects scripts.
• Turning off Smart App Control by changing the VerifiedAndReputablePolicyState registry value.

It then goes after the defences directly. It disables Microsoft Defender, User Account Control and notifications, adds Defender exclusions for processes such as regasm.exe and dwm.exe, tries to uninstall ESET, McAfee and Malwarebytes, and edits the hosts file to block antivirus vendor domains. It also disables System Restore and the Volume Shadow Copy Service, so the usual Windows rollback options are gone when the victim tries to recover. Payloads are injected into RegAsm.exe, dwwin.exe or dwm.exe.

What attackers are doing

Dr.Web says the first infected repositories appeared about two years ago and targeted cryptocurrency users, with blockchain game projects, game bots and cheats whose instructions walked victims through installing Visual Studio and cloning the repo. The switch to security tooling aims at a more valuable audience.

The final payloads are a backdoor and two stealers. Two copies of BackDoor.AsyncRAT.115 run on different ports, which Dr.Web suggests may let two operators control one machine at once. Trojan.Clipper.688 swaps cryptocurrency wallet addresses in the clipboard and sends screenshots to a Telegram bot. JS.Stealer.191 checks for virtual machines and sandboxes, then takes browser data, FileZilla XML files, MobaXterm.ini, Total Commander's wcx_ftp.ini, VPN settings, game accounts and Discord tokens, and ships them out over Telegram. For a penetration tester, that stealer list covers the saved sessions to client environments.

Dr.Web also found an unfinished module, shipped as Lodge.7z with an Electron app named WUDFHost.exe, that appears built to restore removed components and handle updates. No use of it has been confirmed.

What to do

Vet a tool before you build it. Prefer the original project and its signed releases over a fork or a "helper" repo with few stars and a recent creation date. Before opening the solution, search the project files for build hooks:

git grep -n -i -E "PreBuildEvent|PostBuildEvent|<Exec |powershell" -- "*.csproj" "*.vcxproj" "*.props" "*.targets"

Check Directory.Build.props and Directory.Build.targets as well, since MSBuild imports them automatically. A public repository that ships a .suo file or a .vs folder is a red flag; delete both before opening it. For Python and Go, look for hidden long lines with grep -rnE "\s{100,}\S" --include="*.py" --include="*.go" . and turn on word wrap.

Build in a disposable machine. Use a throwaway VM or Windows Sandbox with no saved credentials, no VPN profiles and no access to client networks. Note that JS.Stealer.191 checks for VMs, so a clean result in a sandbox does not prove the tool is safe; it only proves the stealer did not run there.

Hunt on endpoints. Look for Microsoft.exe outside C:\Windows and C:\Program Files, and for the folder C:\ProgramData\Windows.Microsoft.Photos. In Sysmon, filter Event ID 1 for ParentImage ending in MSBuild.exe or devenv.exe with an Image of powershell.exe, and Event ID 11 for .ps1 files created under C:\Users\Public\Pictures. Review Defender exclusions with Get-MpPreference | Select ExclusionProcess, ExclusionPath, where regasm.exe or dwm.exe should never appear. Check the hosts file for antivirus vendor domains, and run vssadmin list shadows to see whether shadow copies were wiped.

Block the known infrastructure. Dr.Web lists the domains muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com and muckdeveloper[.]com and the IP address 130.12.182[.]172, with full hashes in its malware-iocs GitHub repository.

If a machine is hit, rebuild it. The loader turns off the tools you would use to clean it, so reimage rather than disinfect. Then rotate everything the stealer could reach: browser-saved passwords and session cookies, FileZilla and MobaXterm credentials, VPN profiles, Discord tokens, and any SSH keys or client credentials stored on that laptop. Move any cryptocurrency in wallets used on it.

The wider lesson for security teams

Security staff run unvetted code more often than anyone else in the company, usually with admin rights, on the machine that holds client access. A short rule set helps: tools from GitHub are built and first run in a disposable VM, project files get read before Build, and the team keeps an internal list of vetted tools and versions.

Our red team code review covers this kind of build-time backdoor in third-party code, and security operations can hunt for this loader across your endpoints. To ask about either, open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Doctor Web, BleepingComputer, SecurityLab, Comss.ru.