A Widespread Malware Campaign on GitHub Impersonates Legitimate Software to Steal Sensitive Data
A sophisticated threat actor has created nearly 300 fake GitHub repositories that mimic legitimate software and security projects, tricking users into downloading infostealer malware. The campaign’s success relies on users’ trust in free downloads of premium tools, with the malware collecting sensitive data from over 19 web browsers, 32 cryptocurrency wallets, and messaging apps.
The researchers at Arctic Wolf discovered the activity after one of their products was impersonated in the campaign, starting on June 26. They found that each fake repository included a README file with a download link directing visitors to a malicious page. The landing pages were designed to inspire trust, featuring wording and branding similar to legitimate software providers.
The malware itself is a variant of the BoryptGrab family, which steals a wide range of sensitive data, including passwords, cookies, payment information, and Telegram sessions. What’s particularly concerning is that this variant exhibits a previously undocumented capability to bypass Chrome’s App-Bound Encryption through direct code injection into the browser process.
The malware collects as much data as possible in a single execution, without establishing persistence on the host. This means that forensic evidence is left behind, making it easier for security teams to detect and respond to the threat. The researchers were able to identify several dozen GitHub Pages redirectors still active at the time of their report, although many of the malicious repositories had been removed by GitHub.
While the threat actor’s motivations are unclear, Arctic Wolf assesses that they are likely Russian-speaking and financially motivated. The success of this campaign highlights the importance of caution when interacting with unofficial GitHub pages and downloading software from untrusted sources.
In light of this discovery, security teams should be vigilant in monitoring their networks for suspicious activity and consider implementing breach and attack simulation tests to strengthen their defenses. By understanding how threats like BoryptGrab operate, organizations can better prepare themselves against future attacks and protect their users’ sensitive data.
When interacting with GitHub or other software repositories, it’s essential to remember that “free” downloads of premium tools often come with a hidden cost – your security. Always test every layer before attackers do, and be cautious when visiting unofficial pages. By being mindful of these risks, you can reduce the likelihood of falling victim to sophisticated malware campaigns like this one.
Source: Bleeping Computer — 2026-07-14