BoryptGrab GitHub Supply Chain Malware Campaign — 100+ Malicious Repositories Distributing Multi-Stage Stealer
BoryptGrab GitHub Supply Chain Malware Campaign (TL-2026-0207), also tracked as BoryptGrab Stealer Campaign, is a high-severity malware campaign scored CVSS 7.5, first published 2026-03-10. It carries a reported Russia nexus and is not formally attributed, affects Microsoft Windows, maps to 30 MITRE ATT&CK techniques (T1005, T1027, T1027.013), and is covered by 9 detection rules and 35 indicators of compromise.
Key facts for TL-2026-0207
- Threat ID
- TL-2026-0207
- Also known as
- BoryptGrab Stealer Campaign, GitHub Supply Chain Stealer Operation
- Severity
- HIGH
- CVSS
- 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
- Status
- MONITORING
- Category
- MALWARE
- First published
- 2026-03-10
- Last reviewed
- 2026-03-10
- Attribution confidence
- NONE
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, gaming, cryptocurrency, financial
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 35
Malware and tooling in BoryptGrab GitHub Supply Chain Malware Campaign
Malware and tooling: BoryptGrab, HeaconLoad, TunnesshClient, Vidar, Custom HTTP API on port 5466
A large-scale supply chain attack distributing the BoryptGrab information stealer through over 100 malicious GitHub repositories. Russian-origin threat actors create SEO-optimized fake open-source projects and gaming tools to distribute a multi-stage malware chain including BoryptGrab (C/C++ stealer), TunnesshClient (reverse SSH backdoor), HeaconLoad (Golang downloader), and Vidar variants targeting browser credentials, cryptocurrency wallets, and developer systems.
How BoryptGrab GitHub Supply Chain Malware Campaign works
The BoryptGrab campaign represents a sophisticated supply chain attack leveraging GitHub's trusted reputation to distribute information-stealing malware at scale. Discovered by Trend Micro and publicly disclosed on March 5, 2026, the campaign operates through over 100 malicious GitHub repositories that impersonate legitimate software tools, game cheats, and developer utilities.
The attack chain begins with SEO-optimized GitHub repositories containing README files with search-engine-targeted keywords. Victims are directed through encoded URL redirect chains to fake download pages hosted on GitHub Pages (e.g., voicemod-pro-download-tool.github.io) or attacker-controlled domains (best-tinted.com). The downloaded ZIP archives contain the initial payload.
Four distinct attack routes have been identified:
1. DLL Side-Loading: Executable side-loads a malicious libcurl.dll which XOR+AES-CBC decrypts a launcher from its resource section. The launcher calls an _EntryWrapper_ export function and contacts the C2 at 45.93.20.61:5466 to retrieve payloads.
2. VBS Downloader Chain: Obfuscated VBS scripts with integer array encoding attempt UAC bypass via EnsureElevatedPrivileges, disable Windows Defender by excluding C:\ from scanning via PowerShell, then download binaries from botshield.vu.
3. .NET Embedded VBS: A .NET executable decodes a Base64-embedded VBS downloader that continues the infection chain.
4. Direct HeaconLoad: A Golang downloader establishes persistence via registry Run keys and scheduled tasks, beacons to port 8088, and downloads/executes ZIP bundles.
The primary payload, BoryptGrab, is a C/C++ stealer that bypasses Chrome App Bound Encryption (incorporating code from public GitHub repositories), harvests credentials from 9+ browsers (Chrome, Edge, Firefox, Opera, Brave, Vivaldi, Yandex, CentBrowser, Chromium), steals cryptocurrency wallet files from 30+ wallets (Exodus, Electrum, Ledger, Trezor, Atomic, Binance, Bitcoin Core, Ethereum, and others), extracts Telegram files and Discord tokens, captures screenshots, and performs file grabbing from common directories.
TunnesshClient is a PyInstaller-based reverse SSH backdoor that retrieves encrypted SSH credentials from 193.143.1.104:5000 via a challenge-response mechanism. It supports SOCKS5 proxying (op 5), shell command execution (op 83), file listing (op 76), file exfiltration (op 68), file writing (op 85), file search (op 70), and folder exfiltration as Base64-encoded ZIPs (op 90).
HeaconLoad is a Golang downloader that establishes persistence through registry Run keys and scheduled tasks, beacons to the C2 at port 8088 with system information and build tags, and downloads ZIP bundles for execution.
Build names are used to track infection campaigns: Shrek, Leon, CryptoByte, Sonic, Yaropolk, Yarostnick, Yasno, Kassay, Pisechka, and others. Russian-language comments in source code, Russian variable names, Russian-located C2 infrastructure, and Slavic build names strongly indicate Russian-origin operators.
The campaign has been active since at least April 2025 (earliest repository commits) with malicious ZIPs identified in late 2025. The scale of 100+ repositories with active SEO optimization represents significant operational investment and ongoing threat to the software supply chain.
---
**Revalidated on 2026-03-12**
Revalidation (2026-03-12): The campaign remains confirmed active with no C2 infrastructure takedowns reported. Repository rotation by operators continues -- when repositories are flagged or removed by GitHub, new ones are rapidly created with modified names and descriptions to maintain search engine presence. PCRisk has published end-user removal instructions, confirming infections have reached consumers beyond the initial developer/gamer target audience. The broader 2026 GitHub supply chain threat landscape is intensifying: the Shai-Hulud 2.0 worm campaign exposed 33,185 secrets across 20,649 repositories, UNC6426 exploited the nx npm supply chain for AWS admin access, and RU-APT-ChainReaver-L is conducting parallel supply chain attacks through trusted sites and GitHub. BoryptGrab should be contextualized within this escalating trend of developer-ecosystem-targeting malware. Additional lure categories confirmed by multiple sources include PassFab 4WinKey, Filmora Watermark Remover, and FPS Boosters for Valorant/Call of Duty -- these expand the known social engineering surface beyond the originally documented game cheats and developer tools.
MITRE ATT&CK techniques used in TL-2026-0207
collection
T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data
defense-evasion
T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1053.005 Scheduled Task; T1059.001 PowerShell; T1059.005 Visual Basic; T1204.002 Malicious File
discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1518.001 Security Software Discovery
command-and-control
T1090.001 Internal Proxy; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1572 Protocol Tunneling
initial-access
T1195.002 Compromise Software Supply Chain; T1566.001 Spearphishing Attachment
credential-access
T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
persistence
T1547.001 Registry Run Keys / Startup Folder; T1574.001 DLL
privilege-escalation
T1548.002 Bypass User Account Control
impact
defense-impairment
Affected products and versions in BoryptGrab GitHub Supply Chain Malware Campaign
- Microsoft — Windows
Vulnerable versions: 10; 11; Server 2019; Server 2022 - Google — Chrome
Vulnerable versions: All versions (credential theft) - Microsoft — Edge
Vulnerable versions: All versions (credential theft) - Mozilla — Firefox
Vulnerable versions: All versions (credential theft) - Exodus — Exodus Wallet
Vulnerable versions: All versions (wallet theft) - Ledger — Ledger Live
Vulnerable versions: All versions (wallet theft)
Remediation for BoryptGrab GitHub Supply Chain Malware Campaign
Immediate actions
- Block C2 IPs 45.93.20.61, 45.93.20.195, 193.143.1.104 at network perimeter
- Block domains botshield.vu, best-tinted.com, kiamatka.com at DNS level
- Scan systems for SHA256 hashes of known BoryptGrab, TunnesshClient, and HeaconLoad samples
- Audit Windows Defender exclusion settings for unauthorized C:\ exclusions
- Review scheduled tasks for suspicious XML files in %TEMP% directory
- Check registry Run keys for HeaconLoad persistence entries
- Monitor for network connections on ports 5466, 5000, and 8088
Workarounds
- Avoid downloading software from unverified GitHub repositories
- Verify developer authenticity and repository age before installation
- Use hardware wallets instead of software cryptocurrency wallets
- Enable multi-factor authentication on all accounts
Longer-term hardening
- Implement repository verification policies before downloading from GitHub
- Deploy EDR with behavioral detection for DLL side-loading patterns
- Enforce application whitelisting for scheduled task execution
- Monitor for VBS execution with obfuscated integer arrays
- Alert on SOCKS5 proxy establishment and reverse SSH tunnels
- Segment cryptocurrency wallet files and browser credential stores
- Implement DNS monitoring for C2 callback detection
- Deploy code signing verification for downloaded executables
Weaknesses (CWE) in BoryptGrab GitHub Supply Chain Malware Campaign
CWE-506, CWE-494, CWE-829
Timeline of BoryptGrab GitHub Supply Chain Malware Campaign
- Earliest malicious GitHub repository initial commit detected, establishing campaign infrastructure
- Earliest malicious ZIP files identified in the wild, marking active distribution phase
- Campaign expands to 100+ malicious repositories with multiple attack routes and build names
- Trend Micro publicly discloses BoryptGrab campaign with full technical analysis
- SecurityAffairs, SecurityWeek, and GitHub Blog publish coverage and supply chain security guidance
- Digital Forensics Magazine includes BoryptGrab in weekly news roundup, broadening forensic community awareness [Source: https://digitalforensicsmagazine.com/news-roundup-9th-march-2026/]
- Thailand National Cyber Security Agency (NCSA) includes BoryptGrab in daily Cyber Threat Intelligence bulletin, indicating international government awareness [Source: https://webboard-nsoc.ncsa.or.th/topic/2677/cyber-threat-intelligence-06-march-2026]
- PCRisk publishes consumer-facing BoryptGrab removal guide, indicating real-world infections reaching end-users beyond the developer community [Source: https://www.pcrisk.com/removal-guides/35031-boryptgrab-stealer]
- GBHackers, CyberPress, SOCFortress, and TechInformed publish additional analysis and IOCs
- Campaign remains active with ongoing repository creation and malware distribution
- Revalidation confirms campaign remains active with no C2 takedown; repository rotation continues; no new variants or infrastructure changes detected
- As of 2026-05-29, BoryptGrab remains active: the Russian-origin actor is unidentified and undisrupted (no arrests, no named group), and GitHub abuse via SEO'd fake repos persists through May 2026 per Trend Micro/SecurityWeek. No CVE/KEV applies and no successor supersedes it; flagged repos are reported/removed but the operation continues, warranting MONITORING.
Sources cited for BoryptGrab GitHub Supply Chain Malware Campaign
- Trend Micro — BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages
- SecurityAffairs — Massive GitHub Malware Operation Spreads BoryptGrab Stealer
- SecurityWeek — Over 100 GitHub Repositories Distributing BoryptGrab Stealer
- GBHackers — BoryptGrab Malware Abuses GitHub to Steal Browser and Crypto Wallet Data
- CyberPress — Fake GitHub Repos Push BoryptGrab Stealer To Harvest Browser and Wallet Data
- SOCFortress — Over 100 GitHub Repositories Distributing BoryptGrab Stealer
- TechInformed — GitHub Malware Campaign Uses SEO to Steal Browser and Wallet Data
- GitHub Blog — Strengthening Supply Chain Security
Threats related to BoryptGrab GitHub Supply Chain Malware Campaign
- BoryptGrab Infostealer Campaign Abuses ~292 Fake GitHub Repos Impersonating Legitimate Software
- OkoBot: Multi-Stage Malware Framework Targeting Cryptocurrency Wallets (TookPS/HDUtil/Volume2/SeedHunter)
- Impersonated GitHub Brand Repositories Distribute BoryptGrab-Lineage Infostealer via DLL Side-Loading (Fake Arctic Wolf + 290+ Brands)
Detection coverage for TL-2026-0207
As of 2026-03-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0207 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.