A financially motivated threat actor has been impersonating hundreds of brands on GitHub in a widespread campaign designed to distribute a sophisticated infostealer malware. The operation, uncovered by security researchers at Arctic Wolf, involves the creation of fake repositories that mimic legitimate software downloads from well-known companies. In total, 292 impersonated repositories were identified, spanning categories such as security tools, fintech, cryptocurrency wallets, developer utilities, email providers, macOS applications, and gaming software—including cheat tools.
The attack begins when potential victims are directed to these GitHub pages through search engine results that have been carefully optimized for SEO. Each fake repository contains a README file that looks legitimate, but hidden within it is a download link. That link routes the user through a .github.io page, then through a threat-actor-controlled distribution domain, finally landing on a fake “secure download” page that serves a large ZIP archive. The archive is dynamically generated: every 60 seconds, its filename and payload change, making it harder for automated scanners to flag the exact same file.
Inside the ZIP archive, the victim finds what appears to be a legitimate installer. The archive contains a signed copy of WinGUP (the Google Update updater), but it has been renamed to match the impersonated product. Alongside it is a trojanized version of libcurl.dll. When the user runs the executable, gup.exe side-loads the malicious libcurl.dll, which then decodes and reflectively executes an embedded Windows infostealer entirely in memory. This technique, known as DLL side-loading, allows the malware to run without writing a persistent file to disk, making detection more difficult.
Technical details of the infostealer
The infostealer shares its codebase with the previously documented BoryptGrab malware. It features 11 distinct modules designed to harvest a wide range of sensitive data from an infected system. Among its capabilities, the malware collects system information and a list of installed software, then targets browsers including Chrome, Edge, Brave, Yandex, Vivaldi, Chromium, Tor, Epic, Opera, Opera GX, and Firefox. For each browser, it extracts stored credentials, cookies, and autofill data.
Beyond browser data, the malware also targets cryptocurrency wallet extensions installed in browsers, reading local storage and configuration files to steal wallet keys and seeds. It collects Steam session tokens, Meta Max (messenger) credentials, Discord tokens, and Telegram session data. Additionally, it searches the Desktop and Documents folders for files whose names contain strings like “password,” “passwords,” “seeds,” “keys,” “wallet,” “backup,” and “recovery.” It also pulls credentials stored in the Windows Credential Manager.
All stolen data is exfiltrated to a command-and-control (C2) server hosted in Russia, with a hardcoded IP address of 193.143.1.131. The malware does not establish persistence: it does not create Run keys, schedule tasks, write Windows Defender exclusions, or include any VM or debugger detection routines. Arctic Wolf describes it as a pure “smash-and-grab” infostealer—one execution, immediate data collection, and exfiltration, with no foothold left behind. However, it does stage collected data and its own operational logs (such as browser_decryption.log and sends.log) to a temporary output folder and does not delete that folder afterward, leaving a recoverable forensic footprint on disk.
The impersonation strategy
The researchers noted that the impersonated vendors or brands are not at fault—the threat actor is not exploiting any software vulnerability. Instead, they are abusing the trust users place in search engine results and in GitHub, which is owned by Microsoft. The actor appears to be using automation to register throwaway accounts and organizations, creating new fake repositories faster than GitHub can remove them. Language and hosting artifacts point to a Russian-speaking operator, though no connection to a known threat actor or group has been made.
Arctic Wolf flagged the fake “Arctic Wolf” page for removal, and GitHub promptly took it down. However, the researchers emphasize that removal is a reactive game of whack-a-mole. Until GitHub improves proactive detection of malicious repositories impersonating popular brands, the burden falls on users and employees to verify what they download.
Mitigation and detection advice
The researchers advise that users and administrators check for the presence of the temporary output folder on their systems. If it exists, the system has been compromised. In that case, immediate steps include rotating all credentials, browser sessions, and cryptocurrency wallet keys. All browser-stored passwords, cookies, wallets, Discord tokens, Steam tokens, Telegram sessions, Meta Max credentials, and Windows Credential Manager entries should be considered fully compromised.
To avoid falling victim, the researchers recommend sourcing software only from vendor-verified channels. Any .github.io profile repository with a recent creation date, sparse commit history, and a marketing-style README should be treated as suspicious by default. Spoofed trust badges and “secure download” pages are easy to fabricate and prove nothing. The single most useful rule of thumb: legitimate installers do not require running an executable out of a ZIP archive, no matter whose name is on it.
By understanding how this campaign operates—from SEO poisoning to DLL side-loading—organizations and individuals can better defend against similar threats. The cybersecurity community continues to monitor this actor, and researchers have shared indicators of compromise and a Yara rule to help detect malicious activity associated with this campaign.
Source:Help Net Security News