Since 26 June 2026, an unattributed, financially motivated threat actor has operated a large-scale GitHub brand-impersonation campaign, publishing at least 292 organization/profile repositories that mimic trusted security tooling vendors, fintech and personal-finance products, cryptocurrency wallets and exchanges, developer/productivity utilities, secure email providers, macOS utilities, and gaming/cheat software. Each repository hosts a marketing-styled README.md containing a concealed download link. Clicking the link routes the victim through a first-stage *.github.io redirector page (e.g. bentleyvazquezpvey.github.io/.github/Arctic-Wolf) and a second-stage actor-controlled distribution domain (e.g. targetroyena.com) that serves a templated, trust-badge-laden 'secure download' page. Clicking 'Download Secure Content' issues a POST to /download-archive with a user_code and referrer parameter; the server regenerates a uniquely named ZIP archive roughly every 60 seconds to defeat static/hash-based blocking.

The archive contains a legitimate, digitally signed WinGUP updater renamed to match the impersonated product (e.g. Arctic-Wolf-6.86.5.exe), a trojanized libcurl.dll (~9.96 MB), and randomly named filler DLLs used as padding. When the victim runs the renamed gup.exe, Windows' standard DLL search order loads the malicious libcurl.dll from the current directory (classic DLL side-loading / T1574.002). The loader allocates a large memory region, decodes a wordlist-encoded blob using a 256-entry substitution table, validates the resulting buffer for an MZ/PE x64 signature, applies a transient XOR pass, and launches the decoded payload via COM/OLE SafeArray staging rather than the conventional VirtualAlloc+CreateThread pattern, evading many EDR heuristics tuned for classic reflective loading.

The resulting in-memory PE is a BoryptGrab-lineage infostealer sharing 1,638 matched functions (BinDiff score 0.40, ~94% functional overlap) with a previously documented 'reference' BoryptGrab tracked by Trend Micro, but with five architectural divergences (loader design, Chrome bypass method, exfiltration transport, logging behavior, and disk cleanup) suggesting either a distinct operator, an affiliate, or a substantially refactored build. The stealer runs 11 sequential theft modules: system/geolocation fingerprinting; installed-application enumeration; browser credential/cookie theft across 11 Chromium-family browsers plus Firefox (with DPAPI/NSS decryption); full Telegram tdata harvesting; Discord token extraction (stable/canary/PTB); Meta Max messenger credential theft via Windows Credential Manager; Steam live-session token theft via direct process-memory scraping of steamwebhelper.exe/steamservice.exe; a 41-path cryptocurrency wallet grabber spanning roughly 32 distinct wallet brands; a file grabber targeting Desktop/Documents content matching sensitive extensions and keywords (password, seed, key, wallet, backup, recovery); GDI+ screenshot capture; and a full Windows Credential Manager dump.

The most notable technical innovation is a Chrome App-Bound Encryption (ABE v20) bypass: the stealer creates a named shared-memory region, reflectively injects a small (~134 KB) DLL directly into the running browser process via a remote thread targeting a Bootstrap export, and coerces the browser's own IElevator::DecryptData() COM interface from inside the browser's process space to recover the App-Bound decryption key — with no external elevation-service call and no network traffic, making it resistant to the network- and process-tree-based detections that catch most ABE-bypass tooling.

Stolen data (logs, screenshots, and grabbed files) is zipped and exfiltrated over raw Winsock via a chunked-encoded HTTP POST to /upload on a hardcoded C2 at 193.143.1.131, hosted on Proton66 (AS198953, Russia) — a hosting provider repeatedly associated with malware operations. The malware has no persistence mechanism and no anti-analysis/VM-detection logic in this variant, and — unlike the reference BoryptGrab — does not clean up its staging directories (%TEMP%\decrypt_browser\, %TEMP%\Filegraber\) or operational logs (browser_decryption.log, UserInformation.txt, installed_applications.txt, screenshot.png), which materially aids incident-response recovery. The separately tracked 'reference' BoryptGrab lineage additionally distributes a Vidar stealer variant, a Golang downloader named HeaconLoad (registry Run-key and scheduled-task persistence), and a PyInstaller-based reverse-SSH backdoor named TunnesshClient. Internal build-tag strings recovered from samples include 'Shrek', 'Leon', 'CryptoByte', 'Sonic', and 'Yaropolk'. Russian-language comments in delivery-page code, Russian-profanity redirector account handles, and a UTC+1 timezone artifact support a Russian-speaking-operator assessment at low-to-medium confidence.

Arctic Wolf's SecOps team discovered the campaign on 30 June 2026 after identifying a fake repository impersonating their own brand, flagged it to GitHub (removed 2 July 2026), and published a full technical report with IOCs and YARA rules on 13 July 2026. At time of analysis roughly 78 *.github.io redirectors and ~20 distribution/TDS domains were active across six non-Cloudflare bulletproof hosting servers.