Dr.Web says poisoned GitHub security tools now target defenders; 2,000+ PCs infected, no victim split stated

More than 2,000 infected PCs, and no word on how many belong to defenders

Dr.Web, the antivirus company also known as Doctor Web, says infected GitHub repositories are being used to compromise people, and that the latest wave is aimed at the people who test other people's code for a living. In a news item dated 5 November 2026 its researchers say the malicious code sits in Visual Studio projects, Python files and Go files, that the first infected repositories "emerged two years ago" and targeted crypto wallet users, and that the attackers have now moved to projects "related to scanning automation, security system testing, and log analysis". At the time of its research, Dr.Web says, "more than 2,000 PCs" were infected.

That one number is the whole scale of the story, and it carries no breakdown. It is a count of PCs, not organisations. It covers a campaign that began with games, bots and cheats, so it does not say how many of the machines belong to security professionals, which is the claim in the headline Dr.Web chose. This briefing rests on Dr.Web's item and on the indicators README that the item links, both read in full at about 18:15 UTC on Saturday 7 November 2026. BleepingComputer's report of 6 November was also read; it repeats Dr.Web's findings and adds no independent evidence, so it is used only as a cross check. Dr.Web sells security products, and its item ends by saying that two of them detect the malware.

The page is dense with counts, and none of them is a victim count. The table below is this site's tally of what the item lists, labelled derived where a number is ours.

How the code runs: someone builds it or runs it

The mechanism, as Dr.Web gives it, needs the victim to act. The repositories hold Visual Studio projects. In the project file (.csproj) there is a PreBuildEvent routine "that runs malicious code before the project gets compiled", and the solution option files (.suo) carry a PowerShell command. In the newer security themed repositories the malicious payload also includes .go and .py files in which the code is hidden "behind a large number of whitespaces". Dr.Web's own summary of the next step is brief: once the infected files are downloaded, a PowerShell script runs on the user's system.

Two things follow, and one is this site's background rather than Dr.Web's. First, a PreBuildEvent is an ordinary Visual Studio build setting that runs a command before compilation, so the code runs when someone builds the project, not when they read it. Dr.Web says the routine runs before compilation but does not spell out whether opening the solution alone is enough, and it does not say how the .suo command is triggered. Second, whitespace hiding works on a reader, not a machine: the code sits far off to the right of a line that looks blank or harmless on screen. Dr.Web does not say whether the .py and .go files run on import, on a build or on a first run.

The lure for the early victims was also written for people with little technical background. Dr.Web says the attackers "even went as far as to cater for users who might lack sufficient IT background", providing instructions for installing Visual Studio and cloning the repository. For the security audience, the item describes the themes and shows a bogus script for parsing, cleaning and formatting output from the Fscan scanner as an example. The Fscan example is described here by category only. The malicious repositories and their owners are not named, linked or visited by this briefing.

The chain, step by step, as Dr.Web describes it

From the PowerShell script onward the item is specific. The script, which Dr.Web calls PowerShell.Packed.270, is saved to a public folder path, with t.ps1 and L.ps1 in the Pictures folder given as examples. It "can send queries to both attackers' servers and legitimate platforms", Dr.Web says, naming five: YouTube, Telegram, Google Docs, GitCode and Pastebin. The word "including" means the list may not be complete, so the count of five is a minimum drawn from the page (derived). A figure caption in the item shows an encrypted string obtained from Pastebin. Decrypting that string gives the malware a download link for an archive, Quixo.7z, fetched from the attackers' servers or from GitHub and unpacked to a folder under ProgramData.

Zoom

The archive holds an application built on the Electron framework, named Microsoft.exe and detected by Dr.Web as Trojan.Loader.3261; Dr.Web says version 1.4.5 was the latest as of its writing, and that the application has a "complex modular design". Per Dr.Web the loader does the following, in its words or close to them:

• Downloads a further archive, Nexara.7z, holding an encrypted payload, configuration information and auxiliary files.
• Collects system information and relays it to the intruders through a Telegram bot.
• Makes sure it is restarted automatically and uses various techniques to raise its privileges.
• Disables Windows Defender, UAC, notifications, System Restore and VSS, and adds custom Defender exclusions.
• Injects code into legitimate processes, extracts a stealer from a further archive and launches it.
• Removes McAfee, ESET and Malwarebytes antivirus software, and modifies the hosts file.

The loader is the part that most affects an incident response, because several of its steps remove the defender's tools and traces. The hosts file edit keeps "certain domain names associated with antivirus vendors" unreachable, and the malware also deletes everything in the folder that holds the hosts file except a short list of names, so that, Dr.Web says, the user cannot create and use backups of it. Dr.Web does not say which domain names were blocked.

Six evasion techniques, four modes and three payloads

Dr.Web says the operators call their deployment methods modes: mode3, mode2, mode3non and handler. Dr.Web describes mode3 as designed to bypass system protection (BleepingComputer, summarising the item, calls it the default mode; the item itself does not use that word), and lists six techniques, which is the count of evasions this briefing leads with (derived from the list). In Dr.Web's descriptions: the malicious process is given explorer.exe as its parent; the Smart App Control bypass changes a registry value; the loader removes hooks that EDR software may have placed in ntdll.dll by restoring the original file's code from disk; it runs Windows system calls directly through Halo's Gate, which complicates interception by EDR; and it patches Event Tracing for Windows and the AMSI scanning function in the memory of the process. If that works, it injects into one of three processes: RegAsm.exe, dwwin.exe or dwm.exe.

Zoom

The other three modes are described more briefly. Dr.Web says the trojan uses mode2 if it fails to launch the malicious modules: it adds regasm.exe and dwm.exe as Defender exclusions, runs a script it calls PowerShell.Inject.245 that injects the decrypted modules into RegAsm.exe, and checks its connection to the command server with PowerShell and Netstat. Mode3non is "similar to Mode3" but uses different bypass techniques, which the item does not list. Handler deploys the modules as in mode2 with fewer of them and no configuration files, and Dr.Web guesses that it "is legacy deployment method" the operators did not discard; the word is "Perhaps" in the original, so this is Dr.Web's speculation.

All the modes exist to launch three payload files. Dr.Web says two are identical copies of BackDoor.AsyncRAT.115 that differ only in the network ports they use, which "supposedly" lets two operators control one device at once. The third, Trojan.InjectNET.14, injects a clipper, Trojan.Clipper.688, into regasm.exe to swap crypto wallet addresses in the clipboard; while it does so it takes screenshots and sends them to a Telegram bot with the clipper version, the active window title, the user login and the device's IP address. After the payloads are deployed, the loader also unpacks JS.Stealer.191, an Electron application that checks whether it is in a sandbox or virtual machine and then collects the nine categories of user data listed in Technical details: browser data, FileZilla XML files, the MobaXterm configuration file, Total Commander's FTP file, VPN settings, messenger files, game account information and Discord tokens.

Two readings of that list are this site's, not Dr.Web's. Several of the named files belong to tools that administrators use to reach servers, so a stealer pointed at them would suit security staff, though Dr.Web does not say the stealer was built for them. And because mode3 tries to blind the very tools a defender would use to notice it, a quiet EDR console after someone ran one of these projects is weak evidence that nothing happened (inference).

What Dr.Web states, and what it does not

Two small mismatches show the README is a fuller record than the news item. The item prints one IP address, and the README lists a second, ending 209 in its last octet, that the item does not mention. The README also names detections for the stages that the item leaves unnamed, such as Trojan.Loader.3255 for the .suo file. Neither document explains the difference. The README carries a different title from the item's headline. None of this contradicts the item, but a reader should treat the item's one IP address as a sample of the README's, not as the whole list.

The README is also where the scale question gets its only other number. It lists 9 example repository addresses under 8 distinct account names (derived), and calls them examples. By their names they cover crypto games and bots, a Telegram mini game, a login log controller, a proxy tool configuration panel and a formatter for Fscan output. That is a sample of what Dr.Web saw, not a census, and the briefing does not name them.

A security tool, a Microsoft file and a YouTube link: labels doing the work of controls

The campaign works by borrowing trust, and Dr.Web's item lists the loans. The repository is presented as a tool that formats scanner output or analyses logs, which is the kind of thing a security professional expects to run. The main program is called Microsoft.exe and unpacks to a folder named Windows.Microsoft.Photos. The processes it injects into, RegAsm.exe and dwm.exe, are real Windows programs. A later, unfinished component is called WUDFHost.exe, a name also used by a Windows component (this site's background). One of the four attacker domains contains the name of an AI company, Anthropic, which nothing in the item suggests is involved; why the operators chose these names is not stated. And the instructions are fetched from YouTube, Telegram, Google Docs, GitCode and Pastebin, so a proxy that allows those sites by reputation sees nothing unusual (this site's inference).

None of those labels is a control. A name that says Microsoft, a file in a Pictures folder or a link to a well known site establishes nothing about who wrote the code or what it will do. The same is true of the repository itself: Dr.Web does not say whether these repositories had stars, forks or a long history, so the briefing does not claim they were faked, but a repository on a major host is not a vetted one. This site has covered the same habit in its earlier briefings on a fake security audit workflow in GitHub repositories, on the Aoki infostealer and on malicious Terraform providers.

What to do, in order

Items marked as Dr.Web's follow its item. Everything labelled as this site's suggestion is ours, not Dr.Web's. Dr.Web's own advice is short: update antivirus databases regularly and scan all files downloaded from the Internet. That advice comes from a vendor that sells antivirus products.

Technical details

Dr.Web prints no source code of the loader and this briefing prints none. What it does publish is below, copied from its news item and its indicators README as printed, and each block is arranged by this site. Dr.Web's README also lists web addresses of the infected repositories and of live platform pages and GitHub download locations; those are not reproduced, and the malicious repositories, their owners and those pages were not opened. Treat every indicator as used by this campaign and defang anything you share.

First, the files, paths and application names in the infection chain. Use these for file system and process hunting; the folder and file names are in Dr.Web's text, not this site's.

Files carrying the malicious code in Visual Studio projects: .suo, .csproj
In .csproj: the PreBuildEvent routine that runs malicious code before the project gets compiled
In .suo: a PowerShell command
Source files with code concealed behind a large number of whitespaces: .go, .py
PowerShell.Packed.270 path examples: C:\Users\Public\Pictures\t.ps1 , C:\Users\Public\Pictures\L.ps1
Archive Quixo.7z unpacked to: C:\ProgramData\Windows.Microsoft.Photos
Electron application: Microsoft.exe (Trojan.Loader.3261), version 1.4.5 the latest as of Dr.Web's writing
Further archives: Nexara.7z, Nexara/Nvdia.7z (JS.Stealer.191), Lodge.7z (unfinished Electron project, executable WUDFHost.exe)

Second, the evasion artifacts. They matter for defenders because several suppress logging. The registry entry is given as a value name only: Dr.Web does not print the key path, so a defender needs to search for the value name rather than a full path.

Registry value changed to disable Smart App Control: VerifiedAndReputablePolicyState
ETW patch: ntdll.dll!EtwEventWrite, altered in the memory of the respective process
AMSI patch: AmsiScanBuffer, in amsi.dll
ntdll.dll unhooking: the original ntdll.dll is read from disk and matched against the process's code section
Parent process spoofed: explorer.exe
Mode3 injection targets: RegAsm.exe, dwwin.exe, dwm.exe
Mode2 Windows Defender exclusions added: regasm.exe and dwm.exe

Third, the module, configuration and payload names. The key names show how the modules are stored, and the injected process pairing shows what to look at in a memory or process review.

Module files in Nexara.7z: boot_f, kernel_f, thread_f (encrypted)
Key names in Nexara /manifest/config.json: b_f, k_f, t_f
Mode2 library: thumbcache_{11..20}.dll
Mode2 script: PowerShell.Inject.245, saved to the temp folder as a file with a random name
Mode2 injection: boot_f, kernel_f, thread_f into RegAsm.exe; cryptwizard into dwwin.exe (this file does not exist as of Dr.Web's writing; launch flag false)
Payloads: BackDoor.AsyncRAT.115 (two files), Trojan.InjectNET.14 (injects Trojan.Clipper.688 into regasm.exe), JS.Stealer.191

Fourth, the traces the loader leaves on the host and what it takes away. A host with these changes has been tampered with beyond an ordinary infection.

Antivirus products the trojan tries to remove: ESET, McAfee, Malwarebytes
File modified: system32\drivers\etc\hosts, so that certain domain names associated with antivirus vendors remain inaccessible
Also removed from system32\drivers\etc\: all files and folders except the whitelist: hosts, networks, protocol, services, lmhosts.sam
Windows features disabled: Windows Defender, UAC, notifications, System Restore and VSS

Fifth, what the stealer collects. These are the files to treat as exposed on an affected machine.

JS.Stealer.191 steals the following user data, as Dr.Web lists it:
Browser data
FileZilla's XML files
The MobaXterm file MobaXterm.ini
Total Commander's wcx_ftp.ini file
VPN settings
Messenger files
Video game account information
Game platform account data
Discord tokens

Sixth, the four domains and one address printed in the item, already defanged by Dr.Web. One domain contains the name of a company that is not involved on Dr.Web's account. Block and search these in DNS, proxy and firewall logs, and do not browse to them.

muckanthropic[.]com
muckduck.duckdns[.]org
muckcoding[.]com
muckdeveloper[.]com
130.12.182[.]172

Seventh, the fuller network list from the README. It carries the same domains and address with the request paths the stages use, plus a second address, ending 209, that the item does not list. The README prints one domain without the bracketed dot, and this site added the brackets in that one line; it also removed stray trailing quotation marks and semicolons that the README leaves on some lines. The lines for live platforms and GitHub locations, which the README prints as ordinary addresses, are left out.

Trojan.Loader.3255:
hxxps[:]//muckanthropic[.]com/LG/Api-Certificate
hxxps[:]//muckcoding[.]com/LG-LW/Api-Certificate
hxxp[:]//130[.]12.182[.]172/ApiCertificate.txt
hxxps[:]//muckdeveloper[.]com/LGTV/Api-Certificate

PowerShell.Packed.270:
hxxp[:]//130[.]12.182[.]172/MicrosoftCur[.]txt
hxxps[:]//muckanthropic[.]com/LG/MicrosoftCur
hxxps[:]//muckdeveloper[.]com/LGTV/MicrosoftCur

Quixo.7z:
hxxp[:]//130[.]12.182[.]172/Quixo[.]7z
hxxps[:]//muckduck.duckdns[.]org/Quixo[.]7z

Nexara.7z:
hxxps[:]//muckanthropic[.]com/LG/Nexara
hxxps[:]//muckduck[.]duckdns[.]org/Nexara[.]txt
hxxp[:]//130[.]12[.]182[.]172/Nexara[.]7z

Lodge.7z:
hxxps[:]//muckanthropic[.]com/LG/Lodge
hxxps[:]//muckduck[.]duckdns[.]org/Lodge[.]txt
hxxp[:]//130[.]12[.]182[.]172/Lodge[.]7z

Lodge version:
hxxps[:]//muckanthropic[.]com/LG/SysVersion
hxxps[:]//muckduck[.]duckdns[.]org/SysVersion[.]txt

Asar Files Lodge:
hxxps[:]//muckanthropic[.]com/LG/SysUpdate
hxxps[:]//muckduck[.]duckdns[.]org/SysUpdate[.]txt

Microsoft.exe version:
hxxps[:]//muckanthropic[.]com/LG/MicVersion
hxxps[:]//muckduck[.]duckdns[.]org/MicVersion[.]txt

Also in the README, as printed: 130[.]12.182[.]209

Eighth, the sample hashes and detection names from the README, for matching against file inventories and EDR. There are 17 rows. The file column holds file names as Dr.Web prints them, including a Python file name that Dr.Web gives for the Fscan themed lure.

SHA-1 | File | Detection
a15b30b88546d715179f68b4c1581914e05fd3f1 | .suo | Trojan.Loader.3255
85fc0f50963c77d576e52852a51af0ee7824a7ce | .suo | Trojan.Loader.3255
49958ff87c15b78e329aa57334a0349ecfe9d911 | .suo | Trojan.Loader.3255
8d41c48ba6567c2f6cae2990c18b3e20c79afebe | *.csproj | Trojan.Starter.8458
149ad5d02974a4867d0fe9b1176b246b36017c40 | resource.go | Trojan.Starter.8459
b6d65832e95355f6864197b3cd81b9a5d1807036 | FscanOutput_v2.2.py | Python.Downloader.271
96e2cd242f1b6ef98e3b8dd1dc387309ca30055d | t.ps1, L.ps1 | PowerShell.Packed.270
dfb1f3ad1b3b3b910d3b986b206d0b3ef469f5dd | t.ps1, L.ps1 (decoded) | PowerShell.DownLoader.3080
57cd17e88e4f64efb9681fa45c8845c337c05751 | t.ps1, L.ps1 | PowerShell.DownLoader.3080
b9d6a75a254420af3b6ec82be99fb9b5b9202253 | app.asar (Microsoft.exe) | Trojan.Loader.3261
4d177b8143102965b510b8cf098578c788ec915b | led.dll | Trojan.Starter.8447
ef3edf9846ec945806e5c3fa95e3cd207f142520 | app.asar (SearchFilterHost.exe) | JS.Stealer.191
79b1156b89bf906cadcc93b68f67d528e289ed2d | app.asar (WUDFHost.exe) | Trojan.Siggen34.29867
68805c7ca2af697a71c10e7da9694a8202396142 | *.ps1 | PowerShell.Inject.245
ed3b7ec91ce882aa235fed14877ad58514f53de9 | boot_f (decrypted) | BackDoor.AsyncRAT.115
1ad7549378c2af3be2417426cc41852e4d7b6206 | kernel_f (decrypted) | BackDoor.AsyncRAT.115
b83b3cd9ee7f00365308429f58c71170f5f93acc | thread_f (decrypted) | Trojan.InjectNET.14

Finally, a defender's check that this site suggests and Dr.Web does not print. It lists the Microsoft Defender exclusions on a machine, which the loader is said to add to. These are read only commands built into Windows, and a result listing regasm.exe or dwm.exe is worth a close look (derived, not from Dr.Web).

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess

The question the item leaves open

Dr.Web's item shows a two year old campaign that learned a new audience, with a chain built to blind the tools that audience trusts, and a count of more than 2,000 infected PCs with no split by who they were. The people whose job is to read other people's code before it runs are being handed code that runs when they build it. When did your team last build a stranger's security tool on a machine that holds your credentials, and what would have told you it was already running?

Key facts