# Operation Muck and Load: Malicious Go Module (dnsub-scanning-tool) Fronts 222-Repo GitHub Malware Lure Network Delivering AsyncRAT/Quasar and Vidar

> Socket Threat Research identified a malicious Go module, github.com/kaleidora/dnsub-scanning-tool, posing as a DNS/subdomain scanner that instead launches a hidden PowerShell loader chain to deliver AsyncRAT/Quasar RATs and Vidar infostealer. The campaign, dubbed Operation Muck and Load, spans 222 confirmed GitHub repositories across 190 accounts using automated commit-farming workflows and public dead-drop services (Pastebin, Telegram, Instagram, YouTube, GitCode, Google Docs) to stage a password-protected 7z archive of malware masquerading as legitimate Microsoft/Exodus binaries.

- **Published:** 2026-07-08T00:00:00Z
- **Last reviewed:** 2026-07-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1160
- **ID:** TL-2026-1160
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 48 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On July 8, 2026, Socket Threat Research (Kirill Boychenko) disclosed a large-scale open-source supply-chain malware campaign tracked as 'Operation Muck and Load.' The entry point is a Go module, github.com/kaleidora/dnsub-scanning-tool, published under the account 'kaleidora' and masquerading as a legitimate DNS/subdomain enumeration tool. Since its first malicious release on January 24, 2026, the module has accumulated over 1,200 published versions, of which more than 700 contain malicious code, an anomalous publication cadence intended to bury detection and maximize proxy-cache persistence on the Go module mirror.

When imported/built, the module's init logic silently launches `powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass` to retrieve a Base64/encoded blob from `muckcoding[.]com/LG-LW/Api-Certificate`, writes it to `C:\Users\Public\Pictures\api.db`, and decodes it in place with the living-off-the-land binary `certutil -decode` into `C:\Users\Public\Pictures\L.ps1`. L.ps1 is a layered PowerShell loader that XOR-decrypts (32-byte hardcoded key `UIA14fogylw8ogL82FntOFGp6`) two nested encrypted blobs, disables TLS certificate validation (`ServerCertificateValidationCallback = { $true }`) and forces TLS 1.2, then performs a dead-drop-resolver lookup: it polls public, hard-to-block services (Pastebin, a URL shortener, YouTube, Instagram, Telegram, Google Docs, and GitCode) for a specific marker string `LastW`, extracting the next-stage URL or payload from otherwise innocuous-looking public content. This dead-drop-resolver technique lets the actor rotate final payload locations without touching the malicious Go module itself, defeating static IOC blocklisting.

The resolved payload is a password-protected archive `Quixo.7z` (password `r8NnX1b8Xn`, secondary observed password `73hvdu342`), fetched in one cluster directly from a GitHub release asset (`github.com/tb78/expresso/releases/download/Release/Quixo.7z`) — abusing GitHub's own CDN as free, trusted-domain hosting. The archive is extracted with a renamed/side-loaded 7-Zip binary (`C:\ProgramData\zipathh\7zrr.exe`) to `C:\Users\Public\Documents\umun\`, and the final payload is executed from a masqueraded path, `C:\ProgramData\Windows.Microsoft.Photos\current\Microsoft.exe`, despite being digitally signed by 'Exodus Movement, Inc.' rather than Microsoft — a code-signing mismatch indicating a stolen, leaked, or otherwise repurposed legitimate certificate.

Confirmed payloads across the 222-repository lure network include AsyncRAT and Quasar RAT (open-source .NET remote access trojans providing keylogging, screenshot capture, credential/browser data theft, remote shell, file upload/download, and persistence), Vidar infostealer (confirmed in 5+ repositories; targets browser credentials, cookies, cryptocurrency wallets, and Microsoft Authentication Library (MSAL) token caches), Remcos RAT (in a related GitHub-hosted Quixo.7z variant), XMRig/BitMiner Monero cryptominers, a dedicated `CaptureScreens.ps1` screenshot-exfiltration script, and byte-identical `Loader.exe` droppers repeated across 4 separate repositories — indicating shared tooling/templates rather than 222 independently authored campaigns.

The GitHub side of the operation is sustained by an automated commit-farming workflow: a GitHub Actions job runs on an every-minute schedule, configures the local git identity to the threat-actor-linked email `ischhfd83@rambler[.]ru`, but sets the *visible* commit author/username to the repository's actual owner handle — masking the true operator identity in the commit history UI. The workflow writes synthetic `LOG` file changes and force-pushes them via the third-party action `ad-m/github-push-action@master`, producing a continuous stream of green commit activity that makes dormant, malware-laced repositories appear actively maintained and trustworthy to victims and to GitHub's own abuse-scoring heuristics. Malware is distributed three ways: directly committed into repository source trees, staged as GitHub Release assets, and hidden inside filenames using right-to-left-override (RLO) Unicode characters to disguise `.scr` executables as benign document types.

Lure repository themes are optimized for high-value, technically sophisticated victim populations: cryptocurrency wallet tooling (Exodus, MetaMask, Trust Wallet, WalletConnect), Web3 SDKs, exchange-automation/trading bots (Binance P2P), payment-API integrations, game cheats/hacks for PUBG, Escape from Tarkov, and Valorant, crypters/FUD tools, Discord and Telegram bot frameworks, and password-recovery utilities — the dnsub-scanning-tool itself targets security researchers and penetration testers specifically.

Socket's writeup ties the `ischhfd83@rambler.ru` commit-farming email to activity previously documented by Sophos researchers Matt Wixey and Andrew O'Donnell, suggesting this operator has a longer-running history of GitHub-hosted malware distribution beyond this single Go-module campaign. Following disclosure, the Go security team blocked the malicious module from the official Go module proxy (proxy.golang.org), cutting off new installs via `go get`/`go install`, though the 222 GitHub repositories and their release assets remained independently reachable at time of reporting. No CVE has been assigned; this is a supply-chain / malware-distribution campaign rather than a software vulnerability.

## MITRE ATT&CK

- T1608.001 Upload Malware
- T1195.001 Compromise Software Dependencies and Development Tools
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1564.003 Hidden Window
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1105 Ingress Tool Transfer
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1548.002 Bypass User Account Control
- T1053.005 Scheduled Task
- T1543.003 Windows Service
- T1555.003 Credentials from Web Browsers
- T1113 Screen Capture
- T1082 System Information Discovery
- T1057 Process Discovery
- T1012 Query Registry
- T1490 Inhibit System Recovery
- T1496 Resource Hijacking

## Sources

- [Malicious Go Module Exposes GitHub Malware Lure Network](https://socket.dev/blog/malicious-go-module-exposes-github-malware-lure-network?utm_medium=feed)
- [Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation](https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/)
- [Fast, Broad, and Elusive: How Vidar Stealer 2.0 Upgrades Infostealer Capabilities](https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html)
- [Vidar Malware: Azure Credential Targeting and Chrome v20 Decryption Analysis](https://www.ontinue.com/resource/blog-vidar-stealer-malware-analysis/)
- [Quasar RAT: Open-Source Remote Access Trojan Analysis](https://hunt.io/malware-families/quasar)
- [Quasar RAT (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat)
- [Emulating the Open-Source Remote Access Trojan AsyncRAT](https://www.attackiq.com/2024/05/24/emulating-asyncrat/)
- [AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks](https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/asyncrat-malware-explained/)
- [Asyncrat Malware: Fileless RAT Attack Techniques](https://www.levelblue.com/blogs/levelblue-blog/asyncrat-in-action-fileless-malware-techniques-and-analysis-of-a-remote-access-trojan)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1160