GoKawiilGitHub malware campaign plants backdoors in fake security tool repositories
Dr.Web researchers identified a GitHub-based campaign, running for roughly two years, that distributes trojanized security tools such as a fake Fscan output-formatting script to compromise Windows machines. The attackers have infected more than 2,000 systems, embedding malicious code in Visual Studio, Python and Go files that triggers a PowerShell-based infection chain delivering an Electron loader called Microsoft.exe, which disables security protections and injects further malware into legitimate processes.
GoKawiil's interpretation of the reporting above, not reported fact.
The shift from targeting crypto and gaming users toward cybersecurity professionals suggests attackers see security researchers as a high-value route into sensitive networks and tools. Because the malicious code hides in build files and uses whitespace obfuscation plus system-call evasion, it could bypass casual code review and antivirus detection, raising the risk for anyone who pulls open-source security utilities without careful vetting.
- Over 2,000 Windows systems compromised via fake GitHub security tool repositories, per Dr.Web.
- Campaign evolved from crypto/gaming lures to targeting cybersecurity professionals' tools.
- Malware uses an Electron-based loader (Microsoft.exe) with six techniques to evade detection and disable security defenses.
YubiKey 5 NFC Security Key — With attackers hiding backdoors in trusted-looking GitHub repos aimed at security pros, hardening your own authentication is a smart move. A YubiKey adds phishing-resistant two-factor protection to your GitHub, email, and other critical accounts, so even if malware steals saved credentials, attackers can't log in without the physical key. It's a simple, durable way to raise your personal security baseline.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-11-06
Published there as: “Fake security tools on GitHub push backdoors and infostealers”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.