The Security Tool You Downloaded Is the Malware: Fake GitHub Repos Infect 2,000+ Windows PCs

Doctor Web found fake security tools on GitHub that run malware when you build them. How the trap works and what to check before building cloned code.

You find a small helper on GitHub that cleans up the output of a network scanner. It has a README, a Visual Studio project and build instructions. You clone it and press Build. Nothing looks wrong, but by the time the compiler starts, a hidden command has already run on your workstation.

That is the trap Doctor Web described on November 5, 2026. Its researchers found GitHub repositories posing as tools for scan automation, security testing and log analysis, and counted more than 2,000 infected Windows PCs at the time of the research. This article explains how the trap works, why it catches experienced engineers, and what to check before you build code you have just cloned.

What Doctor Web found

According to Doctor Web’s report, the first infected repositories appeared about two years ago. Back then they were aimed at crypto wallet users and were presented as blockchain games, game bots and cheats. The operators have now switched to information security professionals. One of the fake repositories contained a script to parse, clean and format the output of the Fscan network scanner.

This is not a software vulnerability and there is no CVE to patch. It is a supply-chain and social-engineering campaign: the attackers publish a project that looks useful and wait for someone to build it. BleepingComputer’s summary of the research calls the whitespace trick an old technique that still proves effective.

How the trap works

Doctor Web found the malicious code in three kinds of files. None of them is the file a reviewer normally opens first.

Where it hides	What happens	Why it is easy to miss
.csproj project file	A PreBuildEvent runs a command before the project compiles	Reviewers read the source code, not the project file
.suo file	The file carries a PowerShell command	It is a binary settings file that Visual Studio normally keeps in a hidden folder
Python and Go source files	The malicious code sits behind a large number of whitespace characters	The line looks empty unless you scroll far to the right or turn on word wrap

From there the chain is the same. A PowerShell script (the report gives C:\Users\Public\Pictures\t.ps1 and L.ps1 as examples) asks the attackers’ servers, or legitimate services such as YouTube, Telegram, Google Docs, GitCode and Pastebin, for an encrypted string. Decrypted, the string is a download link for an archive that is unpacked to C:\ProgramData\Windows.Microsoft.Photos.

Inside is an Electron-based loader named Microsoft.exe, which Doctor Web detects as Trojan.Loader.3261. The loader reports system details through a Telegram bot, tries to gain higher privileges, and turns off Windows Defender, User Account Control, notifications, System Restore and volume shadow copies. It also tries to remove ESET, McAfee and Malwarebytes products and edits the hosts file to block antivirus vendor domains.

To stay unnoticed, the loader’s default mode makes explorer.exe appear to be its parent process, changes the VerifiedAndReputablePolicyState registry value to get past Smart App Control, restores the original code of ntdll.dll to remove the hooks that security products place there, makes direct system calls, and patches the Windows functions used for event tracing and script scanning. It then injects its payloads into legitimate Windows processes such as RegAsm.exe.

Three payloads follow:

• Two AsyncRAT backdoors. The files are identical but use different network ports, which Doctor Web says may let two operators control the same device at once.
• A clipper. It replaces crypto wallet addresses in the clipboard and sends screenshots, the active window title, the user login and the IP address to a Telegram bot.
• An infostealer (JS.Stealer.191). It checks for sandboxes and virtual machines, then collects browser data, FileZilla, MobaXterm and Total Commander connection files, VPN settings, messenger files, game account data and Discord tokens, and sends them through a Telegram bot.

Doctor Web also found an unfinished component that would install a Windows service and download the loader again if it is deleted. That suggests the operators are still developing the toolset.

Why it works on professionals

The campaign is built around habits that usually count as good practice.

• Building from source feels safer than running a download. Many engineers refuse to run an unknown binary but will happily compile a project, because they can read the code. Here the code they read is clean, and the command lives in the build configuration.
• There is no “run this program” moment. The command starts as part of an ordinary build, so the usual pause before launching an unknown program never comes.
• GitHub is a trusted place. A repository with a tidy README and install instructions looks like thousands of honest projects. Doctor Web notes that the attackers even supplied instructions for installing Visual Studio and cloning the repository.
• An engineer’s workstation holds the keys. Saved browser sessions, VPN profiles and server connection files are exactly what the infostealer collects, and they often open the way into production systems and customer environments.

What to check before you build

These checks take a few minutes and work for any project you have just cloned, on Windows, Linux or macOS. Run them in the repository folder before you open the project in an IDE.

# 1. Build hooks and command execution in project files
grep -rniE 'PreBuildEvent|PostBuildEvent|<Exec |powershell|cmd\.exe' \
  --include='*.csproj' --include='*.vbproj' --include='*.vcxproj' \
  --include='*.props' --include='*.targets' .

# 2. Visual Studio user-option files that should not be in a repository
find . -name '*.suo'

# 3. Files with very long runs of spaces or tabs on one line
grep -rlE '[[:space:]]{200,}' .

On Windows without a Unix-style shell, PowerShell does the same job for the whitespace check:

Get-ChildItem -Recurse -File |
  Select-String -Pattern '\s{200,}' -List |
  Select-Object -ExpandProperty Path

A hit is not proof of malware. Many honest projects use build events, and minified files contain long lines. It is a reason to open the file and read what the command does before anything runs.

1. Read the build files first. Project files, Makefiles, setup.py, package install scripts and CI files can all run commands. Read them as carefully as the source.
2. Delete .suo files and .vs folders that arrive with a repository. They are per-user settings and a project does not need them to build.
3. Turn on word wrap or visible whitespace in your editor when you review unfamiliar code.
4. Look at the repository’s history. A new account, a single large commit, few real issues or contributors, and a tool that duplicates a well-known project are all reasons for more care. Stars and forks alone prove little, because they can be faked.
5. Build unknown code in a throwaway environment. Use a disposable virtual machine or container with no saved passwords, no VPN profile and no SSH keys, and delete it afterwards.

If you already built one

Doctor Web has published file hashes, domains, addresses and example repository names in its indicators of compromise list. Signs described in the report include:

• a folder C:\ProgramData\Windows.Microsoft.Photos or a program named Microsoft.exe;
• t.ps1 or L.ps1 in C:\Users\Public\Pictures;
• Windows Defender exclusions for regasm.exe or dwm.exe that you did not add;
• antivirus vendor domains in the hosts file, or System Restore and shadow copies switched off;
• security software that has disappeared or stopped updating.

If you find any of these, or you know you built a project from the list, act as if everything on that machine has been read:

1. Disconnect the workstation from the network and tell your security team.
2. From a different, clean device, change the passwords saved in the browser and sign out of active sessions, so that stolen session cookies stop working.
3. Replace VPN profiles and the passwords or keys stored in FTP and terminal clients, and review the servers they could reach.
4. Reset Discord and other messenger sessions, and move crypto assets to a wallet created on a clean device.
5. Reinstall the operating system instead of cleaning it. The loader switches off security and recovery features and installs two backdoors, so a cleaned system is hard to trust.

How LOGIQ can help

LOGIQ helps organisations run open source software safely, from enterprise Linux and OpenJDK to the build and deployment pipelines around them. If you want a second pair of eyes on how your teams bring outside code into their environment, or need help separating build systems from the credentials that matter, talk to us.