# Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)

> Dr.Web reports a roughly two-year GitHub campaign in which trojanized repositories posing as security automation, network scanning and log-analysis tools deliver AsyncRAT, a cryptocurrency clipper and an information stealer. More than 2,000 Windows systems are reported compromised.

- **Published:** 2026-11-06T19:18:46Z
- **Last reviewed:** 2026-11-07T06:14:14.949Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5440
- **ID:** TL-2026-5440
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 60 (3 shown free below)

## Description

Doctor Web (Dr.Web) researchers identified GitHub repositories masquerading as security tools (network scanning, security testing, log analysis). Earlier iterations of the campaign targeted cryptocurrency users with fake crypto bots and game auto-farm cheats; the lures later shifted to security professionals. Malicious code is concealed in Visual Studio project and solution files, Python scripts and Go source files and hidden behind long runs of whitespace so it is not visible on casual review.

In the Visual Studio variant, a pre-build event executes during compilation, so the victim's own build of the 'tool' triggers the infection. A PowerShell script (Dr.Web: PowerShell.DownLoader.3080) retrieves an encrypted string from Pastebin, decrypts it to obtain a download link for an archive (Quixo.7z), and unpacks it. The archive contains an Electron-based modular loader named Microsoft.exe, classified by Dr.Web as Trojan.Loader.3261. The IOC list also references gitcode.com-hosted resources and Telegram channels (t.me/s/...) that appear to hold payload links, plus YouTube video and Google Docs links used as lures.

The loader establishes persistence and elevates privileges. Its default mode (Mode3) spoofs explorer.exe as the parent process, disables Smart App Control through the registry, restores the original ntdll.dll to remove security hooks, makes direct system calls, and patches EtwEventWrite and AmsiScanBuffer to suppress event tracing and AMSI scanning. A fallback mode (Mode2) adds Microsoft Defender exclusions and uses PowerShell to decrypt and inject the payload into RegAsm.exe. The loader also attempts to remove or disconnect ESET, McAfee and Malwarebytes products and interferes with Windows backups.

Final payloads are BackDoor.AsyncRAT.115 (remote access), Trojan.InjectNET.14 (loads a clipper), and an Electron-based information stealer, JS.Stealer.191. The clipper replaces cryptocurrency wallet addresses in the clipboard and also sends screenshots and system information via Telegram. The stealer collects browser data, VPN and messenger files, FileZilla and MobaXterm configurations, gaming accounts, service accounts and Discord tokens and exfiltrates them via a Telegram bot. No threat actor attribution is stated in the sources. Dr.Web published IOCs in the DoctorWebLtd/malware-iocs GitHub repository.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1055 Process Injection
- T1134.004 Access Token Manipulation: Parent PID Spoofing
- T1685 Disable or Modify Tools
- T1685 Disable or Modify Tools
- T1218.009 System Binary Proxy Execution: Regsvcs/Regasm
- T1112 Modify Registry
- T1219 Remote Access Tools
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1528 Steal Application Access Token
- T1113 Screen Capture
- T1567 Exfiltration Over Web Service
- T1565.002 Data Manipulation: Transmitted Data Manipulation
- T1490 Inhibit System Recovery
- T1583.001 Acquire Infrastructure
- T1106 Native API
- T1053.005 Scheduled Task/Job
- T1547.001 Boot or Logon Autostart Execution
- T1497 Virtualization/Sandbox Evasion
- T1552.001 Unsecured Credentials
- T1115 Clipboard Data

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Fake GitHub Security Tool Build Chain Downloads Trojan.Loader.3261 Stage via Pastebin/Quixo.7z — Exploitation** (`TL-2026-5440-SPL-001`)

Detects PowerShell started by a Visual Studio pre-build event chain (MSBuild.exe, devenv.exe or cmd.exe) that references Pastebin raw pastes, Quixo.7z, gitcode.com or Telegram channels. This is the PowerShell.DownLoader.3080 stage that retrieves the Trojan.Loader.3261 Electron loader (Microsoft.exe) when a victim builds a trojanized GitHub 'security tool'.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195, T1204.002, T1059.001, T1127.001
- **Data sources:** sysmon
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
  (ParentImage="*\\MSBuild.exe" OR ParentImage="*\\devenv.exe" OR ParentImage="*\\cmd.exe")
  (CommandLine="*pastebin.com/raw/*" OR CommandLine="*Quixo.7z*" OR CommandLine="*gitcode.com*" OR CommandLine="*t.me/s/*")
| eval ioc_hit=case(match(CommandLine,"(?i)pastebin\\.com/raw/"),"pastebin_staging", match(CommandLine,"(?i)Quixo\\.7z"),"quixo_archive_Trojan.Loader.3261", match(CommandLine,"(?i)gitcode\\.com"),"gitcode_resource", true(),"telegram_channel")
| stats count min(_time) as firstTime max(_time) as lastTime values(ioc_hit) as ioc_hit values(CommandLine) as CommandLine by host, User, ParentImage, ParentCommandLine
| convert ctime(firstTime) ctime(lastTime)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where InitiatingProcessFileName in~ ("MSBuild.exe", "devenv.exe", "cmd.exe")
| where ProcessCommandLine has_any ("pastebin.com/raw", "Quixo.7z", "gitcode.com", "t.me/s/")
| extend IocHit = case(
    ProcessCommandLine has "pastebin.com/raw", "pastebin_staging",
    ProcessCommandLine has "Quixo.7z", "quixo_archive_Trojan.Loader.3261",
    ProcessCommandLine has "gitcode.com", "gitcode_resource",
    "telegram_channel")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, IocHit, SHA1
```

### Sigma

```yaml
title: Fake GitHub Security Tool Build Chain Fetching Trojan.Loader.3261 Stage (Pastebin / Quixo.7z)
id: 6f1c2a4e-5b7d-5e0a-9a31-4d2c8b7e1f01
status: experimental
description: Detects PowerShell launched from a Visual Studio pre-build event chain (MSBuild, devenv or cmd) that references Pastebin raw pastes, Quixo.7z, gitcode.com or Telegram channels, or any process matching Dr.Web published Trojan.Loader.3261 SHA-1 hashes. Matches the PowerShell.DownLoader.3080 stage of the fake GitHub security tools campaign.
references:
  - https://github.com/DoctorWebLtd/malware-iocs/blob/master/Trojan.Loader.3261/README.adoc
  - https://www.bleepingcomputer.com/news/security/fake-security-tools-on-github-push-backdoors-and-infostealers/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.initial-access
  - attack.t1195
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1127.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_parent:
    ParentImage|endswith:
      - '\MSBuild.exe'
      - '\devenv.exe'
      - '\cmd.exe'
  selection_ioc:
    CommandLine|contains:
      - 'pastebin.com/raw/'
      - 'Quixo.7z'
      - 'gitcode.com'
      - 't.me/s/'
  selection_hash:
    Hashes|contains:
      - 'SHA1=a15b30b88546d715179f68b4c1581914e05fd3f1'
      - 'SHA1=85fc0f50963c77d576e52852a51af0ee7824a7ce'
      - 'SHA1=49958ff87c15b78e329aa57334a0349ecfe9d911'
      - 'SHA1=8d41c48ba6567c2f6cae2990c18b3e20c79afebe'
      - 'SHA1=149ad5d02974a4867d0fe9b1176b246b36017c40'
      - 'SHA1=b6d65832e95355f6864197b3cd81b9a5d1807036'
      - 'SHA1=96e2cd242f1b6ef98e3b8dd1dc387309ca30055d'
      - 'SHA1=dfb1f3ad1b3b3b910d3b986b206d0b3ef469f5dd'
      - 'SHA1=57cd17e88e4f64efb9681fa45c8845c337c05751'
      - 'SHA1=b9d6a75a254420af3b6ec82be99fb9b5b9202253'
      - 'SHA1=4d177b8143102965b510b8cf098578c788ec915b'
      - 'SHA1=ef3edf9846ec945806e5c3fa95e3cd207f142520'
      - 'SHA1=79b1156b89bf906cadcc93b68f67d528e289ed2d'
      - 'SHA1=68805c7ca2af697a71c10e7da9694a8202396142'
      - 'SHA1=ed3b7ec91ce882aa235fed14877ad58514f53de9'
      - 'SHA1=1ad7549378c2af3be2417426cc41852e4d7b6206'
      - 'SHA1=b83b3cd9ee7f00365308429f58c71170f5f93acc'
  condition: (selection_img and selection_parent and selection_ioc) or selection_hash
fields:
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - User
falsepositives:
  - Developers legitimately downloading build dependencies from Pastebin or gitcode in a pre-build step
  - Red team or malware analysis labs detonating the published samples
level: high

```

**Known false positives:**

- Developers downloading build dependencies from Pastebin or gitcode in a legitimate pre-build step
- Malware analysts or red teams detonating the published Dr.Web samples in a lab

**Tuning notes:** Scope Image/ParentImage to developer and analyst workstations. Add the Pastebin raw paste IDs published by Dr.Web (qCvmNqcu, 5sJxy9k9, fhQhhXx8, wQMFdmBM, mr6N88Q2, psbSPg5V) for higher fidelity. Requires Sysmon EventCode 1 with command line logging; use Windows 4688 with command line auditing if Sysmon is absent.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fake GitHub Tool Pre-Build PowerShell Downloader (Pastebin/[indicator]) — Exploitation (locked: unlock with TL Creds)
- Trojan.Loader.3261 Loader Hash, Masquerading, RegAsm Injection, Defender and SAC Tampering — Post-Exploitation (locked: unlock with TL Creds)
- Trojan.Loader.3261 C2 Infrastructure and Telegram Exfiltration — C2 / Exfiltration (locked: unlock with TL Creds)
- Fake GitHub Security Tool Build Chain Fetching Trojan.Loader.3261 Stage — Exploitation (locked: unlock with TL Creds)
- Smart App Control Disabled or Defender Exclusion Added (Trojan.Loader.3261 Evasion) — Post-Exploitation (locked: unlock with TL Creds)
- Trojan.Loader.3261 C2 Infrastructure and Telegram Contact from Loader/RegAsm — C2 / Exfiltration (locked: unlock with TL Creds)
- Trojan.Loader.3261 Defense Impairment and RegAsm Injection Host — Post-Exploitation (locked: unlock with TL Creds)
- Trojan.Loader.3261 C2 DNS/IP Contact and Telegram Exfiltration from Loader — C2 / Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 60)

Defanged, TLP:CLEAR.

- IP address: `130.12.182[.]172`
- Domain: `muckanthropic[.]com`
- URL: `hxxps://pastebin[.]com/raw/qCvmNqcu`

Full set of 60 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Fake security tools on GitHub push backdoors and infostealers](https://www.bleepingcomputer.com/news/security/fake-security-tools-on-github-push-backdoors-and-infostealers/)
- [Dr.Web IOCs: Trojan.Loader.3261](https://github.com/DoctorWebLtd/malware-iocs/blob/master/Trojan.Loader.3261/README.adoc)
- [DoctorWebLtd/malware-iocs repository](https://github.com/DoctorWebLtd/malware-iocs)
- [Doctor Web discovered malware on GitHub (techora.ru coverage)](https://techora.ru/news/doktor-veb-obnaruzhil-na-github-malvar-2026-10-29)
- [Троян Microsoft.exe крадёт данные через проекты на GitHub (comss.ru)](https://www.comss.ru/page.php?id=22591)
- [AsyncRAT loader obfuscation, DGAs, decoys and Govno (LevelBlue)](https://levelblue.com/blogs/labs-research/asyncrat-loader-obfuscation-dgas-decoys-and-govno)
- [AsyncRAT Crusade: Detections and Defense (Splunk)](https://www.splunk.com/en_us/blog/security/asyncrat-crusade-detections-and-defense.html)
- [AsyncRAT's open source code sparks surge (The Hacker News)](https://thehackernews.com/2025/07/asyncrats-open-source-code-sparks-surge.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5440