BoryptGrab Infostealer Campaign Abuses ~292 Fake GitHub Repos Impersonating Legitimate Software — Threadlinqs Intelligence
As of 2026-07-14, BoryptGrab Infostealer Campaign Abuses ~292 Fake GitHub Repos Impersonating Legitimate Software is a high-severity malware threat attributed to Unattributed BoryptGrab-lineage operator (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-1338 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Unattributed BoryptGrab-lineage operator · Russia · FINANCIAL
A financially motivated, likely Russian-speaking threat actor published 292 brand-impersonation GitHub repositories (including a fake Arctic Wolf page) that lure victims into downloading a legitimate
Since 26 June 2026, an unattributed, financially motivated threat actor has operated a large-scale GitHub brand-impersonation campaign, publishing at least 292 organization/profile repositories that mimic trusted security tooling vendors, fintech and personal-finance products, cryptocurrency wallets and exchanges, developer/productivity utilities, secure email providers, macOS utilities, and gaming/cheat software. Each repository hosts a marketing-styled README.md containing a concealed download link. Clicking the link routes the victim through a first-stage *.github.io redirector page (e.g. bentleyvazquezpvey.github.io/.github/Arctic-Wolf) and a second-stage actor-controlled distribution domain (e.g. targetroyena.com) that serves a templated, trust-badge-laden 'secure download' page. Clicking 'Download Secure Content' issues a POST to /download-archive with a user_code and referrer parameter; the server regenerates a uniquely named ZIP archive roughly every 60 seconds to defeat static/hash-based blocking.
The archive contains a legitimate, digitally signed WinGUP updater renamed to match the impersonated product (e.g. Arctic-Wolf-6.86.5.exe), a trojanized libcurl.dll (~9.96 MB), and randomly named filler DLLs used as padding. When the victim runs the renamed gup.exe, Windows' standard DLL search order loads the malicious libcurl.dll from the current directory (classic DLL side-loading / T1574.002). The loader allocates a large memory region, decodes a wordlist-encoded blob using a 256-entry substitution table, validates the resulting buffer for an MZ/PE x64 signature, applies a transient XOR pass, and launches the decoded payload via COM/OLE SafeArray staging rather than the conventional VirtualAlloc+CreateThread pattern, evading many EDR heuristics tuned for classic reflective loading.
The resulting in-memory PE is a BoryptGrab-lineage infostealer sharing 1,638 matched functions (BinDiff score 0.40, ~94% functional overlap) with a previously documented 'reference' BoryptGrab tracked by Trend Micro, but with five architectural divergences (loader design, Chrome bypass method, exfiltration transport, logging behavior, and disk cleanup) suggesting either a distinct operator, an affiliate, or a substantially refactored build. The stealer runs 11 sequential theft modules: system/geolocation fingerprinting; installed-application enumeration; browser credential/cookie theft across 11 Chromium-family browsers plus Firefox (with DPAPI/NSS decryption); full Telegram tdata harvesting; Discord token extraction (stable/canary/PTB); Meta Max messenger credential theft via Windows Credential Manager; Steam live-session token theft via direct process-memory scraping of steamwebhelper.exe/steamservice.exe; a 41-path cryptocurrency wallet grabber spanning roughly 32 distinct wallet brands; a file grabber targeting Desktop/Documents content matching sensitive extensions and keywords (password, seed, key, wallet, backup, recovery); GDI+ screenshot capture; and a full Windows Credential Manager dump.
The most notable technical innovation is a Chrome App-Bound Encryption (ABE v20) bypass: the stealer creates a named shared-memory region, reflectively injects a small (~134 KB) DLL directly into the running browser process via a remote thread targeting a Bootstrap export, and coerces the browser's own IElevator::DecryptData() COM interface from inside the browser's process space to recover the App-Bound decryption key — with no external elevation-service call and no network traffic, making it resistant to the network- and process-tree-based detections that catch most ABE-bypass tooling.
Stolen data (logs, screenshots, and grabbed files) is zipped and exfiltrated over raw Winsock via a chunked-encoded HTTP POST to /upload on a hardcoded C2 at 193.143.1.131, hosted on Proton66 (AS198953, Russia) — a hosting provider repeatedly associated with malware operations. The malware has no persistence mechanism and no anti-analysis/VM-detection logic in t
Target sectors: technology, finance, cryptocurrency, gaming, generalconsumer
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583.001, T1585.003, T1608.001, T1608.006, T1566.002, T1204.002, T1059.003, T1547.001, T1053.005, T1574.002