# BoryptGrab GitHub Supply Chain Malware Campaign — 100+ Malicious Repositories Distributing Multi-Stage Stealer

> A large-scale supply chain attack distributing the BoryptGrab information stealer through over 100 malicious GitHub repositories. Russian-origin threat actors create SEO-optimized fake open-source projects and gaming tools to distribute a multi-stage malware chain including BoryptGrab (C/C++ stealer), TunnesshClient (reverse SSH backdoor), HeaconLoad (Golang downloader), and Vidar variants targeting browser credentials, cryptocurrency wallets, and developer systems.

- **Published:** 2026-03-10T12:00:00Z
- **Last reviewed:** 2026-03-10T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0207
- **ID:** TL-2026-0207
- **Severity:** HIGH (CVSS 7.5)
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The BoryptGrab campaign represents a sophisticated supply chain attack leveraging GitHub's trusted reputation to distribute information-stealing malware at scale. Discovered by Trend Micro and publicly disclosed on March 5, 2026, the campaign operates through over 100 malicious GitHub repositories that impersonate legitimate software tools, game cheats, and developer utilities.

The attack chain begins with SEO-optimized GitHub repositories containing README files with search-engine-targeted keywords. Victims are directed through encoded URL redirect chains to fake download pages hosted on GitHub Pages (e.g., voicemod-pro-download-tool.github.io) or attacker-controlled domains (best-tinted.com). The downloaded ZIP archives contain the initial payload.

Four distinct attack routes have been identified:

1. DLL Side-Loading: Executable side-loads a malicious libcurl.dll which XOR+AES-CBC decrypts a launcher from its resource section. The launcher calls an _EntryWrapper_ export function and contacts the C2 at 45.93.20.61:5466 to retrieve payloads.

2. VBS Downloader Chain: Obfuscated VBS scripts with integer array encoding attempt UAC bypass via EnsureElevatedPrivileges, disable Windows Defender by excluding C:\ from scanning via PowerShell, then download binaries from botshield.vu.

3. .NET Embedded VBS: A .NET executable decodes a Base64-embedded VBS downloader that continues the infection chain.

4. Direct HeaconLoad: A Golang downloader establishes persistence via registry Run keys and scheduled tasks, beacons to port 8088, and downloads/executes ZIP bundles.

The primary payload, BoryptGrab, is a C/C++ stealer that bypasses Chrome App Bound Encryption (incorporating code from public GitHub repositories), harvests credentials from 9+ browsers (Chrome, Edge, Firefox, Opera, Brave, Vivaldi, Yandex, CentBrowser, Chromium), steals cryptocurrency wallet files from 30+ wallets (Exodus, Electrum, Ledger, Trezor, Atomic, Binance, Bitcoin Core, Ethereum, and others), extracts Telegram files and Discord tokens, captures screenshots, and performs file grabbing from common directories.

TunnesshClient is a PyInstaller-based reverse SSH backdoor that retrieves encrypted SSH credentials from 193.143.1.104:5000 via a challenge-response mechanism. It supports SOCKS5 proxying (op 5), shell command execution (op 83), file listing (op 76), file exfiltration (op 68), file writing (op 85), file search (op 70), and folder exfiltration as Base64-encoded ZIPs (op 90).

HeaconLoad is a Golang downloader that establishes persistence through registry Run keys and scheduled tasks, beacons to the C2 at port 8088 with system information and build tags, and downloads ZIP bundles for execution.

Build names are used to track infection campaigns: Shrek, Leon, CryptoByte, Sonic, Yaropolk, Yarostnick, Yasno, Kassay, Pisechka, and others. Russian-language comments in source code, Russian variable names, Russian-located C2 infrastructure, and Slavic build names strongly indicate Russian-origin operators.

The campaign has been active since at least April 2025 (earliest repository commits) with malicious ZIPs identified in late 2025. The scale of 100+ repositories with active SEO optimization represents significant operational investment and ongoing threat to the software supply chain.

---

**Revalidated on 2026-03-12**

Revalidation (2026-03-12): The campaign remains confirmed active with no C2 infrastructure takedowns reported. Repository rotation by operators continues -- when repositories are flagged or removed by GitHub, new ones are rapidly created with modified names and descriptions to maintain search engine presence. PCRisk has published end-user removal instructions, confirming infections have reached consumers beyond the initial developer/gamer target audience. The broader 2026 GitHub supply chain threat landscape is intensifying: the Shai-Hulud 2.0 worm campaign exposed 33,185 secrets across 20,649 repositories, UNC6426 exploited the nx npm supply chain for AWS admin access, and RU-APT-ChainReaver-L is conducting parallel supply chain attacks through trusted sites and GitHub. BoryptGrab should be contextualized within this escalating trend of developer-ecosystem-targeting malware. Additional lure categories confirmed by multiple sources include PassFab 4WinKey, Filmora Watermark Remover, and FPS Boosters for Valorant/Call of Duty -- these expand the known social engineering surface beyond the originally documented game cheats and developer tools.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1195.002 Compromise Software Supply Chain
- T1059.005 Visual Basic
- T1059.001 PowerShell
- T1204.002 Malicious File
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1548.002 Bypass User Account Control
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1574.001 DLL
- T1497 Virtualization/Sandbox Evasion
- T1036.005 Match Legitimate Resource Name or Location
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1560 Archive Collected Data
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1090.001 Internal Proxy
- T1572 Protocol Tunneling
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [Trend Micro — BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages](https://www.trendmicro.com/en_us/research/26/c/boryptgrab-stealer-targets-users-via-deceptive-github-pages.html)
- [SecurityAffairs — Massive GitHub Malware Operation Spreads BoryptGrab Stealer](https://securityaffairs.com/189110/malware/massive-github-malware-operation-spreads-boryptgrab-stealer.html)
- [SecurityWeek — Over 100 GitHub Repositories Distributing BoryptGrab Stealer](https://www.securityweek.com/over-100-github-repositories-distributing-boryptgrab-stealer/)
- [GBHackers — BoryptGrab Malware Abuses GitHub to Steal Browser and Crypto Wallet Data](https://gbhackers.com/boryptgrab-malware/)
- [CyberPress — Fake GitHub Repos Push BoryptGrab Stealer To Harvest Browser and Wallet Data](https://cyberpress.org/boryptgrab-steals-wallet-data/)
- [SOCFortress — Over 100 GitHub Repositories Distributing BoryptGrab Stealer](https://socfortress.medium.com/over-100-github-repositories-distributing-boryptgrab-stealer-a0d6da5ab28f)
- [TechInformed — GitHub Malware Campaign Uses SEO to Steal Browser and Wallet Data](https://techinformed.com/github-malware-campaign-uses-seo-to-steal-browser-and-wallet-data/)
- [GitHub Blog — Strengthening Supply Chain Security](https://github.blog/security/supply-chain-security/strengthening-supply-chain-security-preparing-for-the-next-malware-campaign/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0207