Malware Campaign on GitHub Impersonates Legitimate Software, Targets Over 19 Web Browsers and Cryptocurrency Wallets
A sophisticated threat actor has been distributing infostealer malware through nearly 300 fake GitHub repositories that pose as legitimate software projects. The campaign’s success relies on the trustworthiness of these impersonated brands, luring victims with “free downloads” of premium tools and software. Once downloaded, the malware collects sensitive data from over 19 web browsers, cryptocurrency wallets, messaging apps, and social media platforms.
The researchers at Arctic Wolf discovered the campaign after noticing that one of their products was being impersonated on June 26. After further investigation, they found 292 fake repositories on GitHub, each with a README file containing a download link to a malicious page. The landing pages were designed to inspire trust, featuring wording and branding similar to legitimate software projects.
The malware’s delivery mechanism is noteworthy for its simplicity and effectiveness. It relies on a single templated HTML/JS artifact that is reused across all impersonated brands. This script parses the URL path into two segments: a “user_code” (a rotating token tracking the referring repository) and the referrer domain. The page then delivers a ZIP archive containing a trojanized library and a legitimate updater, which gets renamed based on the impersonated product.
When run, the executable side-loads the libcurl.dll, decodes an embedded infostealer in memory, and executes it reflectively. This variant of BoryptGrab is particularly stealthy, as it bypasses Chrome’s App-Bound Encryption through direct code injection into the browser process. The stolen data is compressed before being sent to a Russia-based command-and-control server.
The researchers note that the malware does not establish persistence on the host and is designed to collect as much data as possible in a single execution. Furthermore, there’s no anti-analysis layer, leaving forensic evidence behind when the temporary directory is not wiped after exfiltration staging.
At the time of Arctic Wolf’s report, GitHub had removed most of the malicious repositories, but several dozen GitHub Pages redirectors still remained active. The researchers were unable to attribute the campaign to a specific threat actor, but they suspect that the operator is likely Russian-speaking and financially motivated.
The success of this campaign relies on users trusting “free downloads” of premium software tools. As Arctic Wolf recommends, caution should be exercised when interacting with unofficial GitHub pages. To stay safe, it’s essential to test every layer before attackers do – a mantra echoed in the whitepaper by Picus on breach and attack simulation.
To protect yourself from similar attacks, make sure to:
* Be cautious of “free downloads” of premium software tools
* Verify the authenticity of GitHub repositories and their authors
* Use reputable security software and keep it up-to-date
* Regularly back up your data and use strong passwords
By being vigilant and taking proactive measures, you can reduce the risk of falling victim to such sophisticated malware campaigns.
Source: Bleeping Computer — 2026-07-14