The open-source ecosystem is facing a targeted social engineering campaign that exploits the inherent trust in GitHub. Nearly 300 fake repositories, designed to impersonate security software, macOS utilities, and financial tools, have been deployed to distribute a highly aggressive infostealer.

Add AlexTech.ai asPreferred Source on Google

The operation, uncovered by Arctic Wolf, lures victims through search engine results for legitimate products. The landing pages are engineered to look authoritative, featuring spoofed trust badges and deceptive buttons like "Download Secure Content."

Infection Vector and Payload

The attack utilizes a modular infrastructure where a single HTML/JS template is reused across all impersonated brands. Once the user downloads the ZIP archive, they receive a trojanized libcurl.dll and a legitimate WinGUP updater renamed to match the fake product.

The execution occurs via side-loading: the executable loads the malicious DLL, which then reflectively executes a variant of the BoryptGrab infostealer entirely in memory.

This specific variant exhibits a previously undocumented capability: it can bypass Google Chrome's App-Bound Encryption by injecting code directly into the browser process.

Targeted Data and Exfiltration

The malware is designed for a "smash-and-grab" approach, collecting as much data as possible in a single execution without establishing persistence to avoid detection. Key targets include:

  • Browsers: Passwords, cookies, and payment info from over 19 web browsers.
  • Crypto: Data from 32 different cryptocurrency wallet brands.
  • Messaging: Session tokens for Discord, Steam, and Telegram, as well as Meta's Max app credentials.
  • System: Windows Credential Manager contents and local files containing keywords like "recovery phrase" or "backup".

The stolen data is compressed and exfiltrated to a Russia-based command-and-control (C2) server. Researchers assess the operator is likely a Russian-speaking, financially motivated actor.

A Broader Pattern of GitHub Abuse

This incident is part of a wider trend of platform manipulation. Other recent campaigns have seen over 10,000 repositories targeting AI agents or security researchers via fake Proof-of-Concept (PoC) exploits, as reported by Cybernews.

The weaponization of GitHub highlights a growing risk where open-source trust is leveraged for malicious ends, mirroring other AI-driven threats such as the jailbroken Gemini case used to automate C2 infrastructure.

Mitigation and Outlook

While GitHub has removed many of the malicious repositories, several redirectors via GitHub Pages remain active. The primary defense is user vigilance: avoid downloading premium software from unofficial sources and always verify binary integrity via official hashes.