[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFR62L9wtb3Cz7Oo83_xrH8wVB1YFL_L9cFymNiM3CKE":3},{"article":4,"iocs":54,"watch_terms":66,"solutions":67,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"415d9d57-8226-407e-8a12-f54d00982775","Fake GitHub Security Tools Infect Over 2,000 PCs With Malware","fake-github-security-tools-infect-over-2-000-pcs-with-malware-9cfa6a","Fake GitHub security tools are spreading malware that disables defenses, steals sensitive data and infects over 2,000 PCs. Cybersecurity firm Doctor Web has found malware hidden in GitHub projects that look like security tools. The campaign targets blockchain game fans and, more recently, information security professionals. The researchers discovered that more than 2,000 PCs were […]","Attackers are distributing malware disguised as legitimate security tools on GitHub, targeting blockchain game enthusiasts and information security professionals. The malware disables defenses, steals sensitive data, and has infected over 2,000 PCs. It employs sophisticated evasion techniques and delivers payloads like AsyncRAT, a clipper, and a stealer.","Fake GitHub security tools are spreading malware that disables defenses and steals data from over 2,000 PCs.","https:\u002F\u002Fsecurityaffairs.com\u002F202717\u002Fmalware\u002Ffake-github-security-tools-infect-over-2000-pcs-with-malware.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fimage-16.png","2026-11-09T08:07:39+00:00","2026-11-09T10:00:27.140243+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Doctor Web","vendor",{"name":21,"type":22},"GitHub","product",{"name":24,"type":22},"Visual Studio",{"name":26,"type":22},"Fscan",{"name":28,"type":22},"Electron",{"name":30,"type":22},"Microsoft.exe","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,57,60,63],{"type":35,"value":30,"context":56},"Modular malware app built with Electron framework",{"type":35,"value":58,"context":59},"AsyncRAT","Remote access backdoor payload",{"type":35,"value":61,"context":62},"clipper","Payload that swaps crypto wallet addresses",{"type":35,"value":64,"context":65},"stealer","Payload that steals browser data, configs, tokens, etc.",[18,21,24],{"controls":68,"vendors":149},[69,95,124],{"slug":70,"name":71,"problem":72,"products":73},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":91,"product_name":92,"url":93,"description":94},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"slug":96,"name":97,"problem":98,"products":99},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":125,"name":126,"problem":127,"products":128},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[129,136,142],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":125,"product_name":133,"url":134,"description":135},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":137,"product_name":138,"url":140,"description":141},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":143,"product_name":146,"url":147,"description":148},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[150],{"slug":83,"name":84,"logo_path":85,"roles":151},[152],"affected",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":165},"fake-github-security-tools-spread-malware-to-2000-users","Fake GitHub Security Tools Spread Malware to 2,000+ Users","Attackers exploited the trust professionals place in GitHub as a reputable code-sharing platform by disguising malware as legitimate security tools, targeting both blockchain game enthusiasts and infosec practitioners. Once installed, the malware disabled endpoint defenses, stole sensitive data, and delivered powerful payloads including AsyncRAT and credential stealers. This attack succeeds because users often fail to verify the authenticity or provenance of tools downloaded from public repositories. The incident underscores that even technically sophisticated users can be social-engineered when urgency or professional curiosity overrides verification habits. Supply chain trust in open-source ecosystems must be treated as a security risk, not an assumption.",[158,159,160,161,162,163,164],"CIS Control 14: Security Awareness and Skills Training","MITRE ATT&CK T1566: Phishing","CIS Control 2: Inventory and Control of Software Assets","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":166,"MITRE ATT&CK T1566: Phishing":167,"NIST SP 800-53 SI-2: Flaw Remediation":168,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":169,"CIS Control 14: Security Awareness and Skills Training":170,"CIS Control 2: Inventory and Control of Software Assets":171,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":172},"NIS2 requires organizations to implement incident handling and supply chain security measures; this campaign directly exploited trusted third-party platforms, which falls under supply chain risk management obligations.","Distributing malware disguised as legitimate tools is a form of spear-phishing via service (T1566.003), and mapping this tactic helps defenders identify deceptive delivery mechanisms and build appropriate detection rules.","The malware actively disabled endpoint defenses upon execution; timely patching and hardening of defensive tools would have reduced the attacker's ability to neutralize protections post-infection.","Organizations are required to ensure staff have the competence to perform security-related tasks safely; targeted phishing of infosec professionals reveals a gap in role-specific threat awareness training.","Users — including security professionals — downloaded and executed fake tools without verification; structured awareness training on supply chain risks and software vetting would have reduced susceptibility to this social engineering attack.","An enforced software inventory and allowlisting policy would have prevented unauthorized, unverified executables from GitHub from running on corporate or personal work machines.","Controlling which software is permitted to execute — and who is authorized to install new tools — would have limited the attack surface exploited by fake GitHub repositories targeting privileged security users."]