Dr.Web Reports Fake Security Tools on GitHub Delivering AsyncRAT, a Clipper and a Stealer to More Than 2,000 Windows Machines. Read the .csproj File Before You Build Any Scanner Helper.
If you download a small helper for a security tool from GitHub and build it in Visual Studio, open the .csproj file and read it first. Dr.Web reports a campaign that now targets security professionals with fake scanner helpers, and the malicious code runs in a pre-build step, before you compile anything. BleepingComputer covered the findings on November 6, 2026.
What is reported
Dr.Web says the operators have run this campaign for about two years. It began with lures aimed at crypto wallet holders: fake blockchain games, bots and cheat tools. It has now shifted to repositories that offer scan automation, security testing and log analysis, including a fake script that claims to parse, clean and format output from the Fscan network scanner. Dr.Web reports more than 2,000 compromised Windows systems.
The malicious code is hidden in Visual Studio project files, Python scripts and Go source files, behind long runs of whitespace, so it sits off-screen in a casual read. In some Visual Studio projects a pre-build event runs it before compilation starts. A PowerShell script fetches an encrypted link, and that link delivers an Electron-based loader named Microsoft.exe. The loader sets up persistence, disables Windows security and recovery features, and delivers three payloads: the AsyncRAT backdoor, a clipper that swaps crypto wallet addresses in the clipboard, and an infostealer. The stealer is reported to collect browser data, VPN settings, FTP configurations, gaming account data and Discord tokens, and to send them out through a Telegram bot. Dr.Web also reports that the malware tries to remove ESET, McAfee and Malwarebytes and interferes with Windows backups.
In its default mode the loader is reported to use six evasion techniques, among them making explorer.exe appear as its parent process, restoring the original ntdll.dll from disk to remove security hooks, and patching EtwEventWrite and AmsiScanBuffer in memory. If that fails it falls back to a second mode that adds Microsoft Defender exclusions and injects into RegAsm.exe.
What is not solid
We read retellings, not the research. BleepingComputer's page returned a bot challenge to us, and we did not open Dr.Web's own write-up. We read two aggregator summaries of BleepingComputer's article.
Labels differ. One summary calls it a cyber espionage campaign. The shared description of the payloads, a clipper and a stealer for crypto and Discord data, reads as financially motivated. We cannot tell which is right and neither can the summaries.
The 2,000 is Dr.Web's count. We do not know how it was derived or over what period.
No actor is named. We have seen no attribution to a group or a country for this campaign.
Indicators
We could not obtain repository names, hashes, domains or the Telegram bot details from the sources we read, so there is nothing to add to the feed and we ingested nothing. Dr.Web's own write-up probably lists them. This is a gap in what we read, not a statement that none exist.
What to check
Read the .csproj, .vbproj and any pre-build or post-build events in a downloaded tool before you build it. Long blank stretches in a source file followed by code far to the right are a warning sign.
Run unvetted tools in a disposable virtual machine with no saved browser sessions, no VPN profile and no wallet.
If someone on your team built one of these helpers, treat that Windows machine as suspect: look for a file named Microsoft.exe outside Windows system folders, new Defender exclusions, and outbound traffic to Telegram's bot interface from a developer workstation.
Rotate browser-saved credentials, VPN settings, FTP logins and Discord tokens from any machine you cannot clear.
Prefer a tool's own release page, checked against the vendor's site, to a lookalike repository found through search.
These checks follow the reported behavior and Dr.Web's reported advice to read project files and use a VM. The specific file and traffic checks are our suggestions, not findings from the research.
Our own context
We have covered this seam before. In July we wrote about 292 brand-impersonation repositories that Arctic Wolf documented, and in March about fake exploit proof-of-concepts aimed at researchers. This campaign is a separate one by Dr.Web's account. We have no sighting of it from our own sensors.
Limits
We did not read Dr.Web's research, we did not test any repository or payload, and we have no indicators. Every number and behavior here is as reported by aggregator summaries of BleepingComputer's article.
Five percent of this is wrong somewhere. It always is. Dr.Web's write-up will correct a detail about the loader or the count.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments