Operation Muck and Load: Malicious Go Module (dnsub-scanning-tool) Fronts 222-Repo GitHub Malware Lure Network Delivering AsyncRAT/Quasar and Vidar — Threadlinqs Intelligence
As of 2026-07-10, Operation Muck and Load: Malicious Go Module (dnsub-scanning-tool) Fronts 222-Repo GitHub Malware Lure Network Delivering AsyncRAT/Quasar and Vidar is a high-severity supply chain threat attributed to Unknown (kaleidora, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 48 indicators of compromise.
Threat ID: TL-2026-1160 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Unknown (kaleidora · FINANCIAL
Socket Threat Research identified a malicious Go module, github.com/kaleidora/dnsub-scanning-tool, posing as a DNS/subdomain scanner that instead launches a hidden PowerShell loader chain to deliver
On July 8, 2026, Socket Threat Research (Kirill Boychenko) disclosed a large-scale open-source supply-chain malware campaign tracked as 'Operation Muck and Load.' The entry point is a Go module, github.com/kaleidora/dnsub-scanning-tool, published under the account 'kaleidora' and masquerading as a legitimate DNS/subdomain enumeration tool. Since its first malicious release on January 24, 2026, the module has accumulated over 1,200 published versions, of which more than 700 contain malicious code, an anomalous publication cadence intended to bury detection and maximize proxy-cache persistence on the Go module mirror.
When imported/built, the module's init logic silently launches `powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass` to retrieve a Base64/encoded blob from `muckcoding[.]com/LG-LW/Api-Certificate`, writes it to `C:\Users\Public\Pictures\api.db`, and decodes it in place with the living-off-the-land binary `certutil -decode` into `C:\Users\Public\Pictures\L.ps1`. L.ps1 is a layered PowerShell loader that XOR-decrypts (32-byte hardcoded key `UIA14fogylw8ogL82FntOFGp6`) two nested encrypted blobs, disables TLS certificate validation (`ServerCertificateValidationCallback = { $true }`) and forces TLS 1.2, then performs a dead-drop-resolver lookup: it polls public, hard-to-block services (Pastebin, a URL shortener, YouTube, Instagram, Telegram, Google Docs, and GitCode) for a specific marker string `LastW`, extracting the next-stage URL or payload from otherwise innocuous-looking public content. This dead-drop-resolver technique lets the actor rotate final payload locations without touching the malicious Go module itself, defeating static IOC blocklisting.
The resolved payload is a password-protected archive `Quixo.7z` (password `r8NnX1b8Xn`, secondary observed password `73hvdu342`), fetched in one cluster directly from a GitHub release asset (`github.com/tb78/expresso/releases/download/Release/Quixo.7z`) — abusing GitHub's own CDN as free, trusted-domain hosting. The archive is extracted with a renamed/side-loaded 7-Zip binary (`C:\ProgramData\zipathh\7zrr.exe`) to `C:\Users\Public\Documents\umun\`, and the final payload is executed from a masqueraded path, `C:\ProgramData\Windows.Microsoft.Photos\current\Microsoft.exe`, despite being digitally signed by 'Exodus Movement, Inc.' rather than Microsoft — a code-signing mismatch indicating a stolen, leaked, or otherwise repurposed legitimate certificate.
Confirmed payloads across the 222-repository lure network include AsyncRAT and Quasar RAT (open-source .NET remote access trojans providing keylogging, screenshot capture, credential/browser data theft, remote shell, file upload/download, and persistence), Vidar infostealer (confirmed in 5+ repositories; targets browser credentials, cookies, cryptocurrency wallets, and Microsoft Authentication Library (MSAL) token caches), Remcos RAT (in a related GitHub-hosted Quixo.7z variant), XMRig/BitMiner Monero cryptominers, a dedicated `CaptureScreens.ps1` screenshot-exfiltration script, and byte-identical `Loader.exe` droppers repeated across 4 separate repositories — indicating shared tooling/templates rather than 222 independently authored campaigns.
The GitHub side of the operation is sustained by an automated commit-farming workflow: a GitHub Actions job runs on an every-minute schedule, configures the local git identity to the threat-actor-linked email `ischhfd83@rambler[.]ru`, but sets the *visible* commit author/username to the repository's actual owner handle — masking the true operator identity in the commit history UI. The workflow writes synthetic `LOG` file changes and force-pushes them via the third-party action `ad-m/github-push-action@master`, producing a continuous stream of green commit activity that makes dormant, malware-laced repositories appear actively maintained and trustworthy to victims and to GitHub's own abuse-scoring heuristics. Malware is distributed three ways: directly committed into reposit
Weaknesses (CWE)
CWE-506, CWE-1104
Target sectors: technology, softwaredevelopment, cryptocurrency, gaming, individualdevelopers, securityresearch
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 48 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1608.001, T1195.001, T1204.002, T1059.001, T1564.003, T1027, T1027.013, T1140, T1036.005, T1562