A Sophisticated Malware Campaign Exploits GitHub Repositories
A threat actor has built a network of over 200 GitHub repositories designed to deliver Windows malware, according to cybersecurity firm Socket. Dubbed “Operation Muck and Load,” this campaign involves 222 lure repositories across 190 accounts that contain a Go module intended to trigger the infection chain.
The malicious module poses as a DNS/subdomain scanning tool built around the legitimate dnsub open source project. To deceive users, it uses excessive horizontal whitespace to hide a PowerShell command that runs before any scanning logic. This command fetches a PowerShell script executed in a way that evades script-execution policy restrictions. The script then locates encrypted payload metadata, decrypts a URL, retrieves a password-protected archive, extracts it, and executes its contents.
The threat actor behind Operation Muck and Load has been using multiple public platforms to host mirrored encrypted resolver material for operational resilience. Instead of relying on a single hardcoded payload URL, the attackers use dead-drop locations embedded in the script, including Pastebin, Rlim, and fallback locations on public platforms such as YouTube, Instagram, Telegram, Google Docs, and GitCode.
Payloads deployed at the end of the execution chain include AsyncRAT, Quasar RAT, a Remcos-style RAT, infostealers, and spyware. While most of the repositories associated with Operation Muck and Load acted as lures, others also delivered malware, either embedded into source trees or through GitHub release assets.
In total, Socket identified at least 14 unique confirmed malware files across the analyzed threat actor workflow repositories. The confirmed payload set included trojan loaders and downloaders, Vidar infostealer, dropper/spyware payloads, and XMRig/BitMiner-related Monero cryptominers.
Operation Muck and Load overlaps with previously observed activity associated with the ‘ischhfd83’ email address, which also included Muck-themed domains. This highlights the importance of monitoring for suspicious behavior on GitHub repositories and staying vigilant against emerging threat actor tactics.
To protect yourself from such attacks, be cautious when downloading code or packages from public repositories. Verify the authenticity of any project and review its dependencies before incorporating them into your own projects. Additionally, ensure that your systems are up-to-date with the latest security patches and regularly scan for malware. By being mindful of these best practices, you can significantly reduce the risk of falling victim to Operation Muck and Load or similar attacks.
Source: SecurityWeek — 2026-07-10