Operation Muck and Load: Malicious Go Module (dnsub-scanning-tool) Fronts 222-Repo GitHub Malware Lure Network Delivering AsyncRAT/Quasar and Vidar
Operation Muck and Load (TL-2026-1160), also tracked as Operation Muck and Load, is a high-severity supply-chain compromise, first published 2026-07-08. It has no confirmed attribution, affects kaleidora (GitHub account) github.com/kaleidora/dnsub-scanning-tool, maps to 24 MITRE ATT&CK techniques (T1012, T1027, T1027.013), and is covered by 9 detection rules and 48 indicators of compromise.
Key facts for TL-2026-1160
- Threat ID
- TL-2026-1160
- Also known as
- Operation Muck and Load
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-08
- Last reviewed
- 2026-07-08
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, softwaredevelopment, cryptocurrency, gaming, individualdevelopers, securityresearch
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 48
Malware and tooling in Operation Muck and Load
Malware and tooling: AsyncRAT, BitMiner, Quasar RAT, Remcos, Vidar, xmrig
Socket Threat Research identified a malicious Go module, github.com/kaleidora/dnsub-scanning-tool, posing as a DNS/subdomain scanner that instead launches a hidden PowerShell loader chain to deliver AsyncRAT/Quasar RATs and Vidar infostealer. The campaign, dubbed Operation Muck and Load, spans 222 confirmed GitHub repositories across 190 accounts using automated commit-farming workflows and public dead-drop services (Pastebin, Telegram, Instagram, YouTube, GitCode, Google Docs) to stage a password-protected 7z archive of malware masquerading as legitimate Microsoft/Exodus binaries.
How Operation Muck and Load works
On July 8, 2026, Socket Threat Research (Kirill Boychenko) disclosed a large-scale open-source supply-chain malware campaign tracked as 'Operation Muck and Load.' The entry point is a Go module, github.com/kaleidora/dnsub-scanning-tool, published under the account 'kaleidora' and masquerading as a legitimate DNS/subdomain enumeration tool. Since its first malicious release on January 24, 2026, the module has accumulated over 1,200 published versions, of which more than 700 contain malicious code, an anomalous publication cadence intended to bury detection and maximize proxy-cache persistence on the Go module mirror.
When imported/built, the module's init logic silently launches `powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass` to retrieve a Base64/encoded blob from `muckcoding[.]com/LG-LW/Api-Certificate`, writes it to `C:\Users\Public\Pictures\api.db`, and decodes it in place with the living-off-the-land binary `certutil -decode` into `C:\Users\Public\Pictures\L.ps1`. L.ps1 is a layered PowerShell loader that XOR-decrypts (32-byte hardcoded key `UIA14fogylw8ogL82FntOFGp6`) two nested encrypted blobs, disables TLS certificate validation (`ServerCertificateValidationCallback = { $true }`) and forces TLS 1.2, then performs a dead-drop-resolver lookup: it polls public, hard-to-block services (Pastebin, a URL shortener, YouTube, Instagram, Telegram, Google Docs, and GitCode) for a specific marker string `LastW`, extracting the next-stage URL or payload from otherwise innocuous-looking public content. This dead-drop-resolver technique lets the actor rotate final payload locations without touching the malicious Go module itself, defeating static IOC blocklisting.
The resolved payload is a password-protected archive `Quixo.7z` (password `r8NnX1b8Xn`, secondary observed password `73hvdu342`), fetched in one cluster directly from a GitHub release asset (`github.com/tb78/expresso/releases/download/Release/Quixo.7z`) — abusing GitHub's own CDN as free, trusted-domain hosting. The archive is extracted with a renamed/side-loaded 7-Zip binary (`C:\ProgramData\zipathh\7zrr.exe`) to `C:\Users\Public\Documents\umun\`, and the final payload is executed from a masqueraded path, `C:\ProgramData\Windows.Microsoft.Photos\current\Microsoft.exe`, despite being digitally signed by 'Exodus Movement, Inc.' rather than Microsoft — a code-signing mismatch indicating a stolen, leaked, or otherwise repurposed legitimate certificate.
Confirmed payloads across the 222-repository lure network include AsyncRAT and Quasar RAT (open-source .NET remote access trojans providing keylogging, screenshot capture, credential/browser data theft, remote shell, file upload/download, and persistence), Vidar infostealer (confirmed in 5+ repositories; targets browser credentials, cookies, cryptocurrency wallets, and Microsoft Authentication Library (MSAL) token caches), Remcos RAT (in a related GitHub-hosted Quixo.7z variant), XMRig/BitMiner Monero cryptominers, a dedicated `CaptureScreens.ps1` screenshot-exfiltration script, and byte-identical `Loader.exe` droppers repeated across 4 separate repositories — indicating shared tooling/templates rather than 222 independently authored campaigns.
The GitHub side of the operation is sustained by an automated commit-farming workflow: a GitHub Actions job runs on an every-minute schedule, configures the local git identity to the threat-actor-linked email `ischhfd83@rambler[.]ru`, but sets the *visible* commit author/username to the repository's actual owner handle — masking the true operator identity in the commit history UI. The workflow writes synthetic `LOG` file changes and force-pushes them via the third-party action `ad-m/github-push-action@master`, producing a continuous stream of green commit activity that makes dormant, malware-laced repositories appear actively maintained and trustworthy to victims and to GitHub's own abuse-scoring heuristics. Malware is distributed three ways: directly committed into repository source trees, staged as GitHub Release assets, and hidden inside filenames using right-to-left-override (RLO) Unicode characters to disguise `.scr` executables as benign document types.
Lure repository themes are optimized for high-value, technically sophisticated victim populations: cryptocurrency wallet tooling (Exodus, MetaMask, Trust Wallet, WalletConnect), Web3 SDKs, exchange-automation/trading bots (Binance P2P), payment-API integrations, game cheats/hacks for PUBG, Escape from Tarkov, and Valorant, crypters/FUD tools, Discord and Telegram bot frameworks, and password-recovery utilities — the dnsub-scanning-tool itself targets security researchers and penetration testers specifically.
Socket's writeup ties the `ischhfd83@rambler.ru` commit-farming email to activity previously documented by Sophos researchers Matt Wixey and Andrew O'Donnell, suggesting this operator has a longer-running history of GitHub-hosted malware distribution beyond this single Go-module campaign. Following disclosure, the Go security team blocked the malicious module from the official Go module proxy (proxy.golang.org), cutting off new installs via `go get`/`go install`, though the 222 GitHub repositories and their release assets remained independently reachable at time of reporting. No CVE has been assigned; this is a supply-chain / malware-distribution campaign rather than a software vulnerability.
MITRE ATT&CK techniques used in TL-2026-1160
Discovery
T1012 Query Registry; T1057 Process Discovery; T1082 System Information Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1564.003 Hidden Window
Persistence
T1053.005 Scheduled Task; T1543.003 Windows Service
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1105 Ingress Tool Transfer
Collection
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools
Impact
T1490 Inhibit System Recovery; T1496 Resource Hijacking
Privilege Escalation
T1548.002 Bypass User Account Control
Credential Access
T1555.003 Credentials from Web Browsers
Resource Development
defense-impairment
Affected products and versions in Operation Muck and Load
- kaleidora (GitHub account) — github.com/kaleidora/dnsub-scanning-tool (Go module)
Vulnerable versions: all published versions since 2026-01-24 (1,200+ versions, 700+ malicious)
Fixed in: module blocked from Go module proxy by Go security team; no clean fixed version exists - GitHub, Inc. — 222 lure repositories across 190 accounts (cryptocurrency wallet tools, Web3 SDKs, game cheats, crypters, Discord/Telegram bots)
Vulnerable versions: all identified repositories/releases
Remediation for Operation Muck and Load
Immediate actions
- Audit Go module dependencies and go.sum/go.mod lockfiles for github.com/kaleidora/dnsub-scanning-tool in any form and remove it immediately
- Block network egress to muckcoding[.]com, muckdeveloper[.]com, and the specific dead-drop URLs listed in IOCs at perimeter DNS/proxy/firewall
- Search endpoint file systems for C:\Users\Public\Pictures\api.db, L.ps1, C:\ProgramData\zipathh\7zrr.exe, C:\Users\Public\Documents\umun\, and C:\ProgramData\Windows.Microsoft.Photos\current\Microsoft.exe
- Hunt for hidden-window PowerShell processes invoked with -WindowStyle Hidden -ExecutionPolicy Bypass and for certutil -decode usage outside normal cert management workflows
- Revoke/rotate any credentials, browser session cookies, and crypto wallet material on hosts where IOCs are found
- Verify authenticity of any binary signed by 'Exodus Movement, Inc.' running outside the actual Exodus wallet application context
Workarounds
- Do not build or execute github.com/kaleidora/dnsub-scanning-tool or any repository under the 190 identified accounts; treat as malicious regardless of stated purpose
Longer-term hardening
- Enforce Go module allowlisting / private module proxy (GOPROXY) with manual review for new third-party dependencies
- Deploy EDR detection for dead-drop-resolver behavior (outbound requests to Pastebin/Telegram/YouTube/Instagram/Google Docs from developer or build endpoints)
- Implement software composition analysis (SCA) scanning (e.g., Socket, OSV-Scanner) in CI/CD to flag anomalous package version-publication cadence and obfuscated init-time network calls
- Educate developers/security researchers on risk of building/running unreviewed 'security tooling' packages from unknown maintainers
- Monitor GitHub Actions workflows in forked/cloned repos for suspicious every-minute cron schedules and third-party force-push actions
Weaknesses (CWE) in Operation Muck and Load
CWE-506, CWE-1104
Timeline of Operation Muck and Load
- Module publishes 1,200+ versions over the campaign lifetime, of which 700+ are confirmed malicious, an anomalous cadence designed to bury detection and exploit Go module proxy caching.
- First malicious version of github.com/kaleidora/dnsub-scanning-tool published to the Go module ecosystem, beginning Operation Muck and Load.
- GitHub Actions commit-farming workflows deployed across an estimated 190 accounts and 222 repositories, using force-pushed synthetic LOG commits on every-minute schedules to fake repository activity.
- Sophos researchers Matt Wixey and Andrew O'Donnell previously document activity linked to the same threat-actor email (ischhfd83@rambler.ru), indicating an established, longer-running operator.
- 222 GitHub repositories and their hosted release assets (including Quixo.7z payloads) remain independently reachable on GitHub at time of disclosure, outside the scope of the Go proxy takedown.
- Socket Threat Research confirms the full scope of the lure network as part of the disclosure: 222 malicious repositories across 190 GitHub accounts, sharing byte-identical Loader.exe droppers across at least 4 repositories.
- Socket Threat Research confirms the final masqueraded payload (C:\ProgramData\Windows.Microsoft.Photos\current\Microsoft.exe) carries a code-signing certificate for 'Exodus Movement, Inc.' rather than Microsoft, indicating a stolen, leaked, or repurposed legitimate certificate.
- The Go security team blocks the malicious github.com/kaleidora/dnsub-scanning-tool module from the official Go module proxy (proxy.golang.org).
- Socket Threat Research (Kirill Boychenko) publishes full technical disclosure of Operation Muck and Load, including the PowerShell loader chain, IOCs, and payload analysis.
Sources cited for Operation Muck and Load
- Malicious Go Module Exposes GitHub Malware Lure Network
- Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation
- Fast, Broad, and Elusive: How Vidar Stealer 2.0 Upgrades Infostealer Capabilities
- Vidar Malware: Azure Credential Targeting and Chrome v20 Decryption Analysis
- Quasar RAT: Open-Source Remote Access Trojan Analysis
- Quasar RAT (Malware Family)
- Emulating the Open-Source Remote Access Trojan AsyncRAT
- AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks
- Asyncrat Malware: Fileless RAT Attack Techniques
Threats related to Operation Muck and Load
Detection coverage for TL-2026-1160
As of 2026-07-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1160 across Splunk SPL, Microsoft KQL and Sigma, covering 48 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1160
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.