Arctic Wolf Labs and Trend Micro jointly documented a large-scale, brand-impersonation malware distribution campaign that began 26 June 2026. The threat actor published at least 292 GitHub repositories and .github profile pages that mimic legitimate software vendors, including security tooling (a fake Arctic-Wolf-Security/.github repository created 30 June 2026 at 17:33:41 UTC, impersonating the real github.com/rtkwlf), fintech/personal-finance apps, cryptocurrency wallets and exchanges, developer/productivity tools, secure email clients, macOS utilities, and gaming/cheat software. Each repository uses an SEO-optimized, marketing-style README with a concealed 'OFFICIAL PAGE' download button that routes through one of roughly 78 active *.github.io redirector accounts (e.g., bentleyvazquezpvey.github.io) to an actor-controlled distribution domain, primarily targetroyena[.]com, which serves a /download-archive?user_code=...&domain=... endpoint. Roughly 20 distribution/TDS domains and 6 non-Cloudflare bulletproof-hosting servers presenting fake 'Github Download · * · Github' landing pages support the operation.

The served ZIP archive regenerates its filename and payload contents on an approximately 60-second cycle to frustrate static detection and takedown. Each archive bundles a legitimate, Authenticode-signed WinGUP updater binary (renamed to a brand-specific gup.exe) alongside a trojanized libcurl.dll (9.96 MB, compiled 29 June 2026 10:55:33 UTC) and padding DLLs. When the victim runs the renamed gup.exe, Windows' standard DLL search order causes it to load the attacker's libcurl.dll from the same user-writable directory (classic DLL side-loading / T1574.002) instead of the legitimate system library.

The malicious libcurl.dll loader executes a multi-stage in-memory chain: it decodes a wordlist-encoded blob (~0x74bef9 bytes) using a byte substitution table, decrypts the embedded payload, validates the resulting MZ/PE x64 header, allocates memory and applies a transient XOR pass, and then stages the final payload using COM/SafeArray OLE APIs (dynamically resolved CoInitializeEx and SafeArray/Variant routines) rather than the conventional VirtualAlloc+CreateThread pattern -- a reflective PE-loading technique (T1620) designed to evade EDR hooks placed on the standard memory-allocation/thread-creation API sequence.

Once staged, the 11-module infostealer executes sequentially and performs no persistence, drops no secondary payload binary to disk long-term, and performs no dedicated anti-analysis/anti-VM checks in this variant -- a deliberate 'smash-and-grab' design that trades stealth-on-disk for speed. It does, however, leave a recoverable staging folder in %TEMP% (decrypt_browser\, Filegraber\ -- note the operator's consistent typo) containing artifacts such as UserInformation.txt, installed_applications.txt, browser_decryption.log, and screenshot.png, which is high-confidence forensic evidence of successful execution even after the process exits.

The stealer's most notable capability is a Chrome App-Bound Encryption (ABE) bypass achieved via direct code injection into the running browser process rather than the more common IElevator COM-hijack approach: it validates the browser-specific CLSID, creates a named shared-memory region via CreateFileMappingW, writes an encrypted master-key blob into it, launches or attaches to the target browser (chrome.exe, msedge.exe, brave.exe, etc.), allocates ~136,704 bytes in the browser process via VirtualAllocEx, writes an injected DLL into that region, resolves its Bootstrap export, and executes it via CreateRemoteThread; the injected code then decrypts the ABE master key in-process and returns it through shared memory. This defeats Chrome's 2024-introduced App-Bound Encryption cookie/credential protection.

Beyond ABE bypass, the 11 modules collect: system fingerprint and geolocation data (21 host fields plus a wallpaper SHA-1 hash used as a quasi-unique machine ID, and IP geolocation via ip-api.com/ipapi.co); installed-application inventory via the Windows Uninstall registry key; credentials and cookies from 19+ browsers across the Chromium and Firefox families plus niche browsers (Comodo Dragon, CocCoc, Torch, 360Browser, Amigo, QQBrowser); full-drive Telegram tdata session theft across desktop, portable, and Microsoft Store installs; Discord tokens across three release channels via DPAPI; Meta Max (Messenger) credentials via CredEnumerate; Steam account data via direct process-memory scanning of steamwebhelper.exe/steamservice.exe; cryptocurrency wallet data from 32 wallet brands across 41 file paths; a keyword/extension-based file grabber targeting Desktop/Documents for terms like 'password', 'seeds', 'keys', 'wallet', 'backup', 'recovery'; a screenshot module; and a full Windows Credential Manager dump. Exfiltration is a raw Winsock POST /upload to the hardcoded C2 193.143.1[.]131 (Proton66 / AS198953, Russia-hosted) with X-Filename and X-Size headers and chunked transfer encoding.

Arctic Wolf's BinDiff comparison against known BoryptGrab samples found 1,638 matched functions, an identical compiler fingerprint (VS2022 17.5.4 loader + VS2010 SP1 stealer core), shared PE section layout, and identical distinctive strings (the 'Filegraber' typo and 'BUILD NAME:' marker), yielding HIGH confidence that this is a BoryptGrab-lineage variant. Actor attribution confidence is LOW: five architectural divergences from documented BoryptGrab builds suggest either a distinct operator working from shared/leaked source or a heavily refactored fork. Russian-language code comments in the delivery layer, profane redirector account handles, and Proton66 Russian hosting all point to a Russian-speaking nexus, but the actor is not attributed to any named group. Arctic Wolf Labs reported the fake Arctic Wolf repository to GitHub on 2 July 2026, which removed it; as of the 3 July 2026 report, 78 of the redirector accounts remained active and all 292 repositories had been enumerated. No BeaconBeagle correlation was found for 193.143.1.131 at time of publication.