Threat actors have recently adopted a troubling tactic, distributing malware through GitHub repositories, disguised as security utilities. This operation has resulted in the infection of over 2,000 computers, demonstrating the effectiveness of their deceptive strategies. A recent investigation by Doctor Web, published on November 5, highlights the extent of this concerning campaign, targeting cybersecurity professionals as well as blockchain gaming enthusiasts.
The nature of the threat is multifaceted, involving the use of Visual Studio projects and scripts written in Python and Go. These malicious tools are designed to deploy various types of malware, including remote access backdoors, cryptocurrency clippers, and credential stealers. Initially, the attack vectors were focused on repositories promoting blockchain games, cryptocurrency bots, and cheats. However, the breadth of the operation has since expanded to encompass other areas, such as scanning automation, security testing, and log analysis.
Malicious files associated with this campaign, particularly .csproj files, contain PreBuildEvent routines that execute prior to code compilation, creating an added layer of stealth. Meanwhile, .suo files are used to carry PowerShell commands. The Python and Go scripts are particularly insidious, as they encrypt harmful instructions within extensive whitespace, making it challenging for even discerning developers to identify these threats during casual source inspection.
To lure unsuspecting users, the threat actors have included straightforward instructions on how to install Visual Studio and clone the repositories, thereby reducing the barrier to execution. Upon execution, these scripts trigger PowerShell.Packed.270, initiating the download of encrypted strings from various attacker-controlled infrastructures or legitimate online services such as YouTube, Telegram, Google Docs, GitCode, and Pastebin. Decryption of these strings ultimately leads to the retrieval of a Quixo.7z file.
Once accessed, the contents of this file are extracted into the C:\ProgramData\Windows.Microsoft.Photos directory, which delivers an Electron-based application named Microsoft.exe. This application has been classified as Trojan.Loader.3261 and serves as the launching pad for more insidious components of the malware. Following this initial deployment, the loader subsequently downloads another compressed file, Nexara.7z, which contains encrypted modules and configuration files.
Notably, the loader utilizes a deployment technique referred to as Mode3, which combines various evasion tactics such as PPID spoofing, tampering with Smart App Control, and manipulating ntdll.dll to execute calls. This complex approach assigns the seemingly benign process explorer.exe as the parent process, while it modifies the VerifiedAndReputablePolicyState to undermine application controls. Furthermore, the malware also employs AMSI and ETW patching to negate aspects of script inspection and telemetry.
The malware’s architecture includes methods for encrypting and injecting decrypted payloads into various legitimate processes such as RegAsm.exe, dwwin.exe, or dwm.exe. In cases of deployment failures, an alternative method—Mode2—will extract encrypted thumbcache DLLs, reconstructing PowerShell.Inject.245 from the configuration data to maintain functionality.
Moreover, two alternative execution paths, referred to as Mode3non and Handler, ensure that the threat actors can exploit their malware further. Ultimately, this cyber operation establishes two instances of AsyncRAT, effectively allowing different operators to control a single compromised host simultaneously.
The campaign’s reach extends to the Trojan.InjectNET.14 variant, which injects Trojan.Clipper.688 into regasm.exe to alter cryptocurrency wallet addresses while discreetly capturing screenshots and sending them via Telegram. Additionally, a specialized Electron-based malware known as JS.Stealer.191 conducts extensive reconnaissance, performing checks for virtualization and sandbox environments before harvesting sensitive information, including browser passwords, cookies, autofill data, Discord tokens, VPN settings, and messaging files.
Doctor Web’s findings also indicate a disturbing focus on various configuration files, including FileZilla XML files, MobaXterm.ini, and Total Commander’s wcx_ftp.ini. The collected data is subsequently compressed and exfiltrated via a Telegram bot managed by the attackers. To maintain persistence within the infected systems, the malware establishes scheduled tasks and modifies registry Run entries, while concurrently attempting to escape detection by disabling Windows Defender, User Account Control (UAC), System Restore, and Volume Shadow Copy (VSS).
The operation shows a clear intent to compromise consumer security software, targeting popular antivirus programs such as ESET, McAfee, and Malwarebytes, even going so far as to redirect antivirus-related domains through hosts-file modifications. Indicators of this malicious campaign include several domains, such as muckanthropic[.]com and muckduck.duckdns[.]org.
Ultimately, this insidious operation underscores how seemingly useful developer tools can be exploited as vehicles for sustained surveillance, credential theft, and the pilfering of cryptocurrency. The attack serves as a somber reminder of the delicate balance between security and vulnerability in the digital age.