# BoryptGrab Infostealer Campaign Abuses ~292 Fake GitHub Repos Impersonating Legitimate Software

> A financially motivated, likely Russian-speaking threat actor published 292 brand-impersonation GitHub repositories (including a fake Arctic Wolf page) that lure victims into downloading a legitimate signed WinGUP updater (gup.exe) side-loading a trojanized libcurl.dll. The DLL decodes and reflectively executes an in-memory BoryptGrab-lineage infostealer that harvests credentials from 19+ browsers, 32 cryptocurrency wallet brands, Telegram, Discord, Steam and Meta Max, and includes a novel Chrome App-Bound Encryption bypass via direct browser-process injection.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1338
- **ID:** TL-2026-1338
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Since 26 June 2026, an unattributed, financially motivated threat actor has operated a large-scale GitHub brand-impersonation campaign, publishing at least 292 organization/profile repositories that mimic trusted security tooling vendors, fintech and personal-finance products, cryptocurrency wallets and exchanges, developer/productivity utilities, secure email providers, macOS utilities, and gaming/cheat software. Each repository hosts a marketing-styled README.md containing a concealed download link. Clicking the link routes the victim through a first-stage *.github.io redirector page (e.g. bentleyvazquezpvey.github.io/.github/Arctic-Wolf) and a second-stage actor-controlled distribution domain (e.g. targetroyena.com) that serves a templated, trust-badge-laden 'secure download' page. Clicking 'Download Secure Content' issues a POST to /download-archive with a user_code and referrer parameter; the server regenerates a uniquely named ZIP archive roughly every 60 seconds to defeat static/hash-based blocking.

The archive contains a legitimate, digitally signed WinGUP updater renamed to match the impersonated product (e.g. Arctic-Wolf-6.86.5.exe), a trojanized libcurl.dll (~9.96 MB), and randomly named filler DLLs used as padding. When the victim runs the renamed gup.exe, Windows' standard DLL search order loads the malicious libcurl.dll from the current directory (classic DLL side-loading / T1574.002). The loader allocates a large memory region, decodes a wordlist-encoded blob using a 256-entry substitution table, validates the resulting buffer for an MZ/PE x64 signature, applies a transient XOR pass, and launches the decoded payload via COM/OLE SafeArray staging rather than the conventional VirtualAlloc+CreateThread pattern, evading many EDR heuristics tuned for classic reflective loading.

The resulting in-memory PE is a BoryptGrab-lineage infostealer sharing 1,638 matched functions (BinDiff score 0.40, ~94% functional overlap) with a previously documented 'reference' BoryptGrab tracked by Trend Micro, but with five architectural divergences (loader design, Chrome bypass method, exfiltration transport, logging behavior, and disk cleanup) suggesting either a distinct operator, an affiliate, or a substantially refactored build. The stealer runs 11 sequential theft modules: system/geolocation fingerprinting; installed-application enumeration; browser credential/cookie theft across 11 Chromium-family browsers plus Firefox (with DPAPI/NSS decryption); full Telegram tdata harvesting; Discord token extraction (stable/canary/PTB); Meta Max messenger credential theft via Windows Credential Manager; Steam live-session token theft via direct process-memory scraping of steamwebhelper.exe/steamservice.exe; a 41-path cryptocurrency wallet grabber spanning roughly 32 distinct wallet brands; a file grabber targeting Desktop/Documents content matching sensitive extensions and keywords (password, seed, key, wallet, backup, recovery); GDI+ screenshot capture; and a full Windows Credential Manager dump.

The most notable technical innovation is a Chrome App-Bound Encryption (ABE v20) bypass: the stealer creates a named shared-memory region, reflectively injects a small (~134 KB) DLL directly into the running browser process via a remote thread targeting a Bootstrap export, and coerces the browser's own IElevator::DecryptData() COM interface from inside the browser's process space to recover the App-Bound decryption key — with no external elevation-service call and no network traffic, making it resistant to the network- and process-tree-based detections that catch most ABE-bypass tooling.

Stolen data (logs, screenshots, and grabbed files) is zipped and exfiltrated over raw Winsock via a chunked-encoded HTTP POST to /upload on a hardcoded C2 at 193.143.1.131, hosted on Proton66 (AS198953, Russia) — a hosting provider repeatedly associated with malware operations. The malware has no persistence mechanism and no anti-analysis/VM-detection logic in this variant, and — unlike the reference BoryptGrab — does not clean up its staging directories (%TEMP%\decrypt_browser\, %TEMP%\Filegraber\) or operational logs (browser_decryption.log, UserInformation.txt, installed_applications.txt, screenshot.png), which materially aids incident-response recovery. The separately tracked 'reference' BoryptGrab lineage additionally distributes a Vidar stealer variant, a Golang downloader named HeaconLoad (registry Run-key and scheduled-task persistence), and a PyInstaller-based reverse-SSH backdoor named TunnesshClient. Internal build-tag strings recovered from samples include 'Shrek', 'Leon', 'CryptoByte', 'Sonic', and 'Yaropolk'. Russian-language comments in delivery-page code, Russian-profanity redirector account handles, and a UTC+1 timezone artifact support a Russian-speaking-operator assessment at low-to-medium confidence.

Arctic Wolf's SecOps team discovered the campaign on 30 June 2026 after identifying a fake repository impersonating their own brand, flagged it to GitHub (removed 2 July 2026), and published a full technical report with IOCs and YARA rules on 13 July 2026. At time of analysis roughly 78 *.github.io redirectors and ~20 distribution/TDS domains were active across six non-Cloudflare bulletproof hosting servers.

## MITRE ATT&CK

- T1583.001 Domains
- T1585.003 Cloud Accounts
- T1608.001 Upload Malware
- T1608.006 SEO Poisoning
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1055.001 Dynamic-link Library Injection
- T1620 Reflective Code Loading
- T1497.001 System Checks
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1518 Software Discovery
- T1012 Query Registry
- T1057 Process Discovery
- T1016 System Network Configuration Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1560.001 Archive via Utility
- T1071.001 Web Protocols
- T1132.001 Standard Encoding
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1020 Automated Exfiltration

## Sources

- [Nearly 300 GitHub repos pose as legit software to push malware](https://www.bleepingcomputer.com/news/security/nearly-300-github-repos-pose-as-legit-software-to-push-malware/)
- [Malicious GitHub Campaign: Fake "Arctic Wolf" and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer](https://arcticwolf.com/resources/blog/fake-github-repositories-deliver-boryptgrab-lineage-infostealer/)
- [GitHub Impersonation Deploys Information Stealer](https://arcticwolf.com/resources/blog/security-bulletin-github-impersonation-deploys-information-stealer/)
- [New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages](https://www.trendmicro.com/en_us/research/26/c/boryptgrab-stealer-targets-users-via-deceptive-github-pages.html)
- [Massive GitHub malware operation spreads BoryptGrab stealer](https://securityaffairs.com/189110/malware/massive-github-malware-operation-spreads-boryptgrab-stealer.html)
- [BoryptGrab Malware Abuses GitHub to Steal Browser and Crypto Wallet Data](https://gbhackers.com/boryptgrab-malware/)
- [BoryptGrab Stealer Spreads via Fake GitHub Repositories, Stealing Browser and Crypto Wallet Data](https://cybersecuritynews.com/boryptgrab-stealer-spreads-via-fake-github-repositories/)
- [Over 100 GitHub Repositories Distributing BoryptGrab Stealer](https://socfortress.medium.com/over-100-github-repositories-distributing-boryptgrab-stealer-a0d6da5ab28f)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1338