GoKawiilGitHub malware campaign plants backdoors in fake security tool repositories
Dr.Web researchers identified a GitHub-based campaign, running for roughly two years, that distributes trojanized security tools such as a fake Fscan output-formatting script to compromise Windows machines. The attackers have infected more than 2,000 systems, embedding malicious code in Visual Studio, Python and Go files that triggers a PowerShell-based infection chain delivering an Electron loader called Microsoft.exe, which disables security protections and injects further malware into legitimate processes.