Skip to navigation

Threat reportMalwareTL-2026-5440

Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)

highACTIVE

Dr.Web reports a roughly two-year GitHub campaign in which trojanized repositories posing as security automation, network scanning and log-analysis tools deliver AsyncRAT, a cryptocurrency clipper and an information stealer. More than 2,000 Windows systems are reported compromised. First disclosed .

Key facts for Fake GitHub AsyncRAT loader

IdentifiersTL-2026-5440
Also known asTrojan.Loader.3261, Quixo loader, Fake GitHub security tools campaign
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsMicrosoft Windows; GitHub Repository hosting (abused as distribution channel)
MalwareAsyncRAT, BackDoor.AsyncRAT.115, Clipper, JS.Stealer.191, PowerShell.DownLoader.3080, Python, Trojan.InjectNET.14, Trojan.Loader.3261
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1036 Masquerading, T1053.005 Scheduled Task/Job, T1055 Process Injection, T1059.001 Command and Scripting Interpreter: PowerShell, T1106 Native API, T1112 Modify Registry, T1113 Screen Capture, T1115 Clipboard Data, T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild, T1134.004 Access Token Manipulation: Parent PID Spoofing, T1195 Supply Chain Compromise and 13 more in the attack flow
MotivationFINANCIAL
Target sectorscybersecurity, information technology, cryptocurrency, gaming
Target regionsGlobal
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for Fake GitHub AsyncRAT loader

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5440 across Splunk SPL, Microsoft KQL and Sigma, covering 60 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Fake GitHub Security Tool Build Chain Downloads Trojan.Loader.3261 Stage via Pastebin/Quixo.7z — Exploitation

Detects PowerShell started by a Visual Studio pre-build event chain (MSBuild.exe, devenv.exe or cmd.exe) that references Pastebin raw pastes, Quixo.7z, gitcode.com or Telegram channels. This is the PowerShell.DownLoader.3080 stage that retrieves the Trojan.Loader.3261 Electron loader (Microsoft.exe) when a victim builds a trojanized GitHub 'security tool'.

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
  (ParentImage="*\\MSBuild.exe" OR ParentImage="*\\devenv.exe" OR ParentImage="*\\cmd.exe")
  (CommandLine="*pastebin.com/raw/*" OR CommandLine="*Quixo.7z*" OR CommandLine="*gitcode.com*" OR CommandLine="*t.me/s/*")
| eval ioc_hit=case(match(CommandLine,"(?i)pastebin\\.com/raw/"),"pastebin_staging", match(CommandLine,"(?i)Quixo\\.7z"),"quixo_archive_Trojan.Loader.3261", match(CommandLine,"(?i)gitcode\\.com"),"gitcode_resource", true(),"telegram_channel")
| stats count min(_time) as firstTime max(_time) as lastTime values(ioc_hit) as ioc_hit values(CommandLine) as CommandLine by host, User, ParentImage, ParentCommandLine
| convert ctime(firstTime) ctime(lastTime)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where InitiatingProcessFileName in~ ("MSBuild.exe", "devenv.exe", "cmd.exe")
| where ProcessCommandLine has_any ("pastebin.com/raw", "Quixo.7z", "gitcode.com", "t.me/s/")
| extend IocHit = case(
    ProcessCommandLine has "pastebin.com/raw", "pastebin_staging",
    ProcessCommandLine has "Quixo.7z", "quixo_archive_Trojan.Loader.3261",
    ProcessCommandLine has "gitcode.com", "gitcode_resource",
    "telegram_channel")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, IocHit, SHA1

Sigma

title: Fake GitHub Security Tool Build Chain Fetching Trojan.Loader.3261 Stage (Pastebin / Quixo.7z)
id: 6f1c2a4e-5b7d-5e0a-9a31-4d2c8b7e1f01
status: experimental
description: Detects PowerShell launched from a Visual Studio pre-build event chain (MSBuild, devenv or cmd) that references Pastebin raw pastes, Quixo.7z, gitcode.com or Telegram channels, or any process matching Dr.Web published Trojan.Loader.3261 SHA-1 hashes. Matches the PowerShell.DownLoader.3080 stage of the fake GitHub security tools campaign.
references:
  - https://github.com/DoctorWebLtd/malware-iocs/blob/master/Trojan.Loader.3261/README.adoc
  - https://www.bleepingcomputer.com/news/security/fake-security-tools-on-github-push-backdoors-and-infostealers/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.initial-access
  - attack.t1195
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1127.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_parent:
    ParentImage|endswith:
      - '\MSBuild.exe'
      - '\devenv.exe'
      - '\cmd.exe'
  selection_ioc:
    CommandLine|contains:
      - 'pastebin.com/raw/'
      - 'Quixo.7z'
      - 'gitcode.com'
      - 't.me/s/'
  selection_hash:
    Hashes|contains:
      - 'SHA1=a15b30b88546d715179f68b4c1581914e05fd3f1'
      - 'SHA1=85fc0f50963c77d576e52852a51af0ee7824a7ce'
      - 'SHA1=49958ff87c15b78e329aa57334a0349ecfe9d911'
      - 'SHA1=8d41c48ba6567c2f6cae2990c18b3e20c79afebe'
      - 'SHA1=149ad5d02974a4867d0fe9b1176b246b36017c40'
      - 'SHA1=b6d65832e95355f6864197b3cd81b9a5d1807036'
      - 'SHA1=96e2cd242f1b6ef98e3b8dd1dc387309ca30055d'
      - 'SHA1=dfb1f3ad1b3b3b910d3b986b206d0b3ef469f5dd'
      - 'SHA1=57cd17e88e4f64efb9681fa45c8845c337c05751'
      - 'SHA1=b9d6a75a254420af3b6ec82be99fb9b5b9202253'
      - 'SHA1=4d177b8143102965b510b8cf098578c788ec915b'
      - 'SHA1=ef3edf9846ec945806e5c3fa95e3cd207f142520'
      - 'SHA1=79b1156b89bf906cadcc93b68f67d528e289ed2d'
      - 'SHA1=68805c7ca2af697a71c10e7da9694a8202396142'
      - 'SHA1=ed3b7ec91ce882aa235fed14877ad58514f53de9'
      - 'SHA1=1ad7549378c2af3be2417426cc41852e4d7b6206'
      - 'SHA1=b83b3cd9ee7f00365308429f58c71170f5f93acc'
  condition: (selection_img and selection_parent and selection_ioc) or selection_hash
fields:
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - User
falsepositives:
  - Developers legitimately downloading build dependencies from Pastebin or gitcode in a pre-build step
  - Red team or malware analysis labs detonating the published samples
level: high

Known false positives:

  • Developers downloading build dependencies from Pastebin or gitcode in a legitimate pre-build step
  • Malware analysts or red teams detonating the published Dr.Web samples in a lab

Tuning notes: Scope Image/ParentImage to developer and analyst workstations. Add the Pastebin raw paste IDs published by Dr.Web (qCvmNqcu, 5sJxy9k9, fhQhhXx8, wQMFdmBM, mr6N88Q2, psbSPg5V) for higher fidelity. Requires Sysmon EventCode 1 with command line logging; use Windows 4688 with command line auditing if Sysmon is absent.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Fake GitHub Tool Pre-Build PowerShell Downloader (Pastebin/[indicator]) — Exploitation · unlock with TL Creds
  • Trojan.Loader.3261 Loader Hash, Masquerading, RegAsm Injection, Defender and SAC Tampering — Post-Exploitation · unlock with TL Creds
  • Trojan.Loader.3261 C2 Infrastructure and Telegram Exfiltration — C2 / Exfiltration · unlock with TL Creds
  • Fake GitHub Security Tool Build Chain Fetching Trojan.Loader.3261 Stage — Exploitation · unlock with TL Creds
  • Smart App Control Disabled or Defender Exclusion Added (Trojan.Loader.3261 Evasion) — Post-Exploitation · unlock with TL Creds
  • Trojan.Loader.3261 C2 Infrastructure and Telegram Contact from Loader/RegAsm — C2 / Exfiltration · unlock with TL Creds
  • Trojan.Loader.3261 Defense Impairment and RegAsm Injection Host — Post-Exploitation · unlock with TL Creds
  • Trojan.Loader.3261 C2 DNS/IP Contact and Telegram Exfiltration from Loader — C2 / Exfiltration · unlock with TL Creds

Indicators of compromise for Fake GitHub AsyncRAT loader

As of 2026-11-07, Threadlinqs Intelligence tracks 60 indicators of compromise for TL-2026-5440.

Sample indicators (3 of 60)

  • IP address: 130.12.182[.]172
  • Domain: muckanthropic[.]com
  • URL: hxxps://pastebin[.]com/raw/qCvmNqcu

Defanged, TLP:CLEAR. Full set of 60 indicators: unlock with TL Creds.

60 indicators of compromise · unlock with TL Creds. Compare plans

How Fake GitHub AsyncRAT loader works

Doctor Web (Dr.Web) researchers identified GitHub repositories masquerading as security tools (network scanning, security testing, log analysis). Earlier iterations of the campaign targeted cryptocurrency users with fake crypto bots and game auto-farm cheats; the lures later shifted to security professionals. Malicious code is concealed in Visual Studio project and solution files, Python scripts and Go source files and hidden behind long runs of whitespace so it is not visible on casual review.

In the Visual Studio variant, a pre-build event executes during compilation, so the victim's own build of the 'tool' triggers the infection. A PowerShell script (Dr.Web: PowerShell.DownLoader.3080) retrieves an encrypted string from Pastebin, decrypts it to obtain a download link for an archive (Quixo.7z), and unpacks it. The archive contains an Electron-based modular loader named Microsoft.exe, classified by Dr.Web as Trojan.Loader.3261. The IOC list also references gitcode.com-hosted resources and Telegram channels (t.me/s/...) that appear to hold payload links, plus YouTube video and Google Docs links used as lures.

The loader establishes persistence and elevates privileges. Its default mode (Mode3) spoofs explorer.exe as the parent process, disables Smart App Control through the registry, restores the original ntdll.dll to remove security hooks, makes direct system calls, and patches EtwEventWrite and AmsiScanBuffer to suppress event tracing and AMSI scanning. A fallback mode (Mode2) adds Microsoft Defender exclusions and uses PowerShell to decrypt and inject the payload into RegAsm.exe. The loader also attempts to remove or disconnect ESET, McAfee and Malwarebytes products and interferes with Windows backups.

Final payloads are BackDoor.AsyncRAT.115 (remote access), Trojan.InjectNET.14 (loads a clipper), and an Electron-based information stealer, JS.Stealer.191. The clipper replaces cryptocurrency wallet addresses in the clipboard and also sends screenshots and system information via Telegram. The stealer collects browser data, VPN and messenger files, FileZilla and MobaXterm configurations, gaming accounts, service accounts and Discord tokens and exfiltrates them via a Telegram bot. No threat actor attribution is stated in the sources. Dr.Web published IOCs in the DoctorWebLtd/malware-iocs GitHub repository.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild; T1134.004 Access Token Manipulation: Parent PID Spoofing; T1218.009 System Binary Proxy Execution: Regsvcs/Regasm; T1497 Virtualization/Sandbox Evasion

Persistence

T1053.005 Scheduled Task/Job; T1547.001 Boot or Logon Autostart Execution

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1106 Native API; T1204.002 User Execution: Malicious File

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

Collection

T1113 Screen Capture; T1115 Clipboard Data

Initial Access

T1195 Supply Chain Compromise

Command and Control

T1219 Remote Access Tools

Impact

T1490 Inhibit System Recovery; T1565.002 Data Manipulation: Transmitted Data Manipulation

Credential Access

T1528 Steal Application Access Token; T1552.001 Unsecured Credentials; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583.001 Acquire Infrastructure

Remediation for Fake GitHub AsyncRAT loader

Immediate actions

  • Hunt for and block the published Dr.Web IOCs (130.12.182.172, 130.12.182.209, muckanthropic.com, muckduck.duckdns.org, muckcoding.com, muckdeveloper.com) at DNS, proxy and firewall
  • Search endpoints for Microsoft.exe running from non-system paths, Quixo.7z downloads, and RegAsm.exe spawned by PowerShell
  • Isolate and reimage hosts where the repositories were built or run; rotate browser-stored credentials, VPN/FTP credentials, Discord tokens and cryptocurrency wallet secrets from affected hosts
  • Block or alert on outbound access to pastebin.com/raw/, gitcode.com and Telegram from workstations where this is not business-justified
  • Check developer and analyst workstations for clones or builds of the listed GitHub repositories

Workarounds

  • Keep Smart App Control and Microsoft Defender tamper protection enabled and alert on any change to them or on new Defender exclusions

Longer-term hardening

  • Require review of Visual Studio .csproj/.vcxproj pre-build and post-build events and project files before building third-party code
  • Build and test untrusted GitHub security tools only in isolated, disposable VMs
  • Deploy EDR with tamper protection and alerting on AMSI/ETW patching, ntdll unhooking and parent PID spoofing
  • Detect hidden-whitespace obfuscation in source repositories with static scanning of third-party code

Affected and fixed versions

  • Microsoft — Windows
    Vulnerable versions: Windows systems on which the trojanized projects are built or run
  • GitHub — Repository hosting (abused as distribution channel)

Timeline of Fake GitHub AsyncRAT loader

Last updated · revalidated 1× · latest source

  • Approximate start of the GitHub malware campaign; Dr.Web/BleepingComputer describe it as roughly two years old, initially targeting cryptocurrency users with fake crypto bots and game auto-farm cheats (exact start date not stated in sources)
  • The Hacker News reported on AsyncRAT's open-source code driving a surge of derivative RAT variants, context for the AsyncRAT payload family used here
  • Doctor Web reported related malware disguised as legitimate software (office programs, game cheats, trading bots) spread via fraudulent GitHub pages and malicious YouTube video description links
  • Russian-language outlets (techora.ru, comss.ru) republished the Dr.Web findings, describing the locked-ioc-57 trojan stealing data via GitHub projects
  • Dr.Web published IOCs for locked-ioc-48 (17 SHA-1 hashes, 4 domains, 2 IPs, 11 repositories, Pastebin, Telegram, YouTube, Google Docs and gitcode links) in the DoctorWebLtd/malware-iocs GitHub repository
  • Doctor Web published research on GitHub repositories posing as security tools distributing locked-ioc-48, locked-ioc-42, locked-ioc-47 and locked-ioc-55, reporting more than 2,000 infected computers
  • Doctor Web news article (dated Nov 5, 2026) details the PreBuildEvent/.suo PowerShell chain, loader modes (Mode3, Mode2, Mode3non, legacy Handler), injection into RegAsm.exe, dwwin.exe and dwm.exe, scheduled-task/Run-key persistence, hosts-file tampering and the locked-ioc-49 detection.
  • BleepingComputer reported the campaign, highlighting new TTPs: whitespace-hidden code, Visual Studio pre-build event execution, PowerShell retrieval of encrypted download links and process injection
  • GBHackers publishes coverage of the Doctor Web findings on fake GitHub security tools infecting over 2,000 computers.

Update history

Sources cited for Fake GitHub AsyncRAT loader

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats