# Impersonated GitHub Brand Repositories Distribute BoryptGrab-Lineage Infostealer via DLL Side-Loading (Fake Arctic Wolf + 290+ Brands)

> Since 26 June 2026, a financially motivated, likely Russian-speaking operator has run an ongoing campaign using 292 fake GitHub repositories impersonating security, fintech, crypto, developer, email, macOS, and gaming brands (including a spoofed Arctic Wolf page). SEO-optimized READMEs route victims through *.github.io redirectors to attacker-controlled distribution domains serving rotating ZIP archives containing a legitimate signed WinGUP updater (renamed gup.exe) and a trojanized libcurl.dll that side-loads and reflectively executes, entirely in memory, an 11-module BoryptGrab-lineage infostealer.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1375
- **ID:** TL-2026-1375
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Arctic Wolf Labs and Trend Micro jointly documented a large-scale, brand-impersonation malware distribution campaign that began 26 June 2026. The threat actor published at least 292 GitHub repositories and .github profile pages that mimic legitimate software vendors, including security tooling (a fake Arctic-Wolf-Security/.github repository created 30 June 2026 at 17:33:41 UTC, impersonating the real github.com/rtkwlf), fintech/personal-finance apps, cryptocurrency wallets and exchanges, developer/productivity tools, secure email clients, macOS utilities, and gaming/cheat software. Each repository uses an SEO-optimized, marketing-style README with a concealed 'OFFICIAL PAGE' download button that routes through one of roughly 78 active *.github.io redirector accounts (e.g., bentleyvazquezpvey.github.io) to an actor-controlled distribution domain, primarily targetroyena[.]com, which serves a /download-archive?user_code=...&domain=... endpoint. Roughly 20 distribution/TDS domains and 6 non-Cloudflare bulletproof-hosting servers presenting fake 'Github Download · * · Github' landing pages support the operation.

The served ZIP archive regenerates its filename and payload contents on an approximately 60-second cycle to frustrate static detection and takedown. Each archive bundles a legitimate, Authenticode-signed WinGUP updater binary (renamed to a brand-specific gup.exe) alongside a trojanized libcurl.dll (9.96 MB, compiled 29 June 2026 10:55:33 UTC) and padding DLLs. When the victim runs the renamed gup.exe, Windows' standard DLL search order causes it to load the attacker's libcurl.dll from the same user-writable directory (classic DLL side-loading / T1574.002) instead of the legitimate system library.

The malicious libcurl.dll loader executes a multi-stage in-memory chain: it decodes a wordlist-encoded blob (~0x74bef9 bytes) using a byte substitution table, decrypts the embedded payload, validates the resulting MZ/PE x64 header, allocates memory and applies a transient XOR pass, and then stages the final payload using COM/SafeArray OLE APIs (dynamically resolved CoInitializeEx and SafeArray/Variant routines) rather than the conventional VirtualAlloc+CreateThread pattern -- a reflective PE-loading technique (T1620) designed to evade EDR hooks placed on the standard memory-allocation/thread-creation API sequence.

Once staged, the 11-module infostealer executes sequentially and performs no persistence, drops no secondary payload binary to disk long-term, and performs no dedicated anti-analysis/anti-VM checks in this variant -- a deliberate 'smash-and-grab' design that trades stealth-on-disk for speed. It does, however, leave a recoverable staging folder in %TEMP% (decrypt_browser\, Filegraber\ -- note the operator's consistent typo) containing artifacts such as UserInformation.txt, installed_applications.txt, browser_decryption.log, and screenshot.png, which is high-confidence forensic evidence of successful execution even after the process exits.

The stealer's most notable capability is a Chrome App-Bound Encryption (ABE) bypass achieved via direct code injection into the running browser process rather than the more common IElevator COM-hijack approach: it validates the browser-specific CLSID, creates a named shared-memory region via CreateFileMappingW, writes an encrypted master-key blob into it, launches or attaches to the target browser (chrome.exe, msedge.exe, brave.exe, etc.), allocates ~136,704 bytes in the browser process via VirtualAllocEx, writes an injected DLL into that region, resolves its Bootstrap export, and executes it via CreateRemoteThread; the injected code then decrypts the ABE master key in-process and returns it through shared memory. This defeats Chrome's 2024-introduced App-Bound Encryption cookie/credential protection.

Beyond ABE bypass, the 11 modules collect: system fingerprint and geolocation data (21 host fields plus a wallpaper SHA-1 hash used as a quasi-unique machine ID, and IP geolocation via ip-api.com/ipapi.co); installed-application inventory via the Windows Uninstall registry key; credentials and cookies from 19+ browsers across the Chromium and Firefox families plus niche browsers (Comodo Dragon, CocCoc, Torch, 360Browser, Amigo, QQBrowser); full-drive Telegram tdata session theft across desktop, portable, and Microsoft Store installs; Discord tokens across three release channels via DPAPI; Meta Max (Messenger) credentials via CredEnumerate; Steam account data via direct process-memory scanning of steamwebhelper.exe/steamservice.exe; cryptocurrency wallet data from 32 wallet brands across 41 file paths; a keyword/extension-based file grabber targeting Desktop/Documents for terms like 'password', 'seeds', 'keys', 'wallet', 'backup', 'recovery'; a screenshot module; and a full Windows Credential Manager dump. Exfiltration is a raw Winsock POST /upload to the hardcoded C2 193.143.1[.]131 (Proton66 / AS198953, Russia-hosted) with X-Filename and X-Size headers and chunked transfer encoding.

Arctic Wolf's BinDiff comparison against known BoryptGrab samples found 1,638 matched functions, an identical compiler fingerprint (VS2022 17.5.4 loader + VS2010 SP1 stealer core), shared PE section layout, and identical distinctive strings (the 'Filegraber' typo and 'BUILD NAME:' marker), yielding HIGH confidence that this is a BoryptGrab-lineage variant. Actor attribution confidence is LOW: five architectural divergences from documented BoryptGrab builds suggest either a distinct operator working from shared/leaked source or a heavily refactored fork. Russian-language code comments in the delivery layer, profane redirector account handles, and Proton66 Russian hosting all point to a Russian-speaking nexus, but the actor is not attributed to any named group. Arctic Wolf Labs reported the fake Arctic Wolf repository to GitHub on 2 July 2026, which removed it; as of the 3 July 2026 report, 78 of the redirector accounts remained active and all 292 repositories had been enumerated. No BeaconBeagle correlation was found for 193.143.1.131 at time of publication.

## MITRE ATT&CK

- T1586 Compromise Accounts
- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1566 Phishing
- T1189 Drive-by Compromise
- T1204 User Execution
- T1106 Native API
- T1574 Hijack Execution Flow
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1036 Masquerading
- T1055 Process Injection
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1518 Software Discovery
- T1614 System Location Discovery
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1074 Data Staged
- T1119 Automated Collection
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1020 Automated Exfiltration

## Sources

- [Attackers use fake GitHub repos to trick developers into downloading infostealer](https://www.helpnetsecurity.com/2026/07/15/impersonated-brands-github-infostealer-download/)
- [Malicious GitHub Campaign: Fake "Arctic Wolf" and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer](https://arcticwolf.com/resources/blog/fake-github-repositories-deliver-boryptgrab-lineage-infostealer/)
- [GitHub Impersonation Deploys Information Stealer - Security Bulletin](https://arcticwolf.com/resources/blog/security-bulletin-github-impersonation-deploys-information-stealer/)
- [New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages](https://www.trendmicro.com/en_us/research/26/c/boryptgrab-stealer-targets-users-via-deceptive-github-pages.html)
- [Nearly 300 GitHub repos pose as legit software to push malware](https://www.bleepingcomputer.com/news/security/nearly-300-github-repos-pose-as-legit-software-to-push-malware/)
- [Massive GitHub malware operation spreads BoryptGrab stealer](https://securityaffairs.com/189110/malware/massive-github-malware-operation-spreads-boryptgrab-stealer.html)
- [BoryptGrab Malware Spreads Through 292 Fake GitHub Repositories](https://windowsreport.com/boryptgrab-malware-spreads-through-292-fake-github-repositories/)
- [BoryptGrab Malware Abuses GitHub to Steal Browser and Crypto Wallet Data](https://gbhackers.com/boryptgrab-malware/)
- [BoryptGrab Stealer Spreads via Fake GitHub Repositories, Stealing Browser and Crypto Wallet Data](https://cybersecuritynews.com/boryptgrab-stealer-spreads-via-fake-github-repositories/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1375