Attackers pursuing cryptocurrency and sensitive data are using GitHub projects to deliver malware that strips away Windows defenses and installs tools for remote access and theft. In a November 9, 2026 report, Security Affairs described Doctor Web’s investigation, which found more than 2,000 PCs infected at the time of its research.
Information security professionals are the campaign’s newer targets. Repositories promise help with automated scanning, security testing and log analysis, including one purported utility for analyzing and cleaning output from the Fscan security scanner. The campaign previously focused on blockchain game enthusiasts who used cryptocurrency wallets.
A project download becomes an infection
The operation began two years ago with Visual Studio projects advertised around blockchain games, bots and cheats. Instructions walked prospective users through installing Visual Studio and downloading the GitHub projects, extending their reach to people with limited technical knowledge.
The malicious instructions were embedded in the development material itself: project files contained commands scheduled to execute before a build, while configuration files held PowerShell commands. Python and Go files also carried malicious code, obscured by large stretches of whitespace.
Opening a project starts a PowerShell script. It reaches both attacker-controlled servers and legitimate services—YouTube, Telegram, Google Docs, GitCode and Pastebin—to retrieve an encrypted string containing an archive link. After extraction, the archive’s contents sit in a directory made to resemble a Windows Photos component.
The central executable is Microsoft.exe, a modular Electron application. It reports system information to a Telegram bot, maintains its execution and elevates privileges. From there, it weakens the computer’s protection and recovery options: Windows Defender, User Account Control, System Restore and shadow copies are disabled. The loader also creates Defender exclusions, injects code into legitimate processes and removes McAfee, ESET and Malwarebytes antivirus products.
Its normal execution path, Mode3, conceals the parent process’s identity and disables Smart App Control. It also strips security software hooks from ntdll.dll, uses direct system calls, and patches event tracing and antivirus script scanning in memory. Failure on that path triggers Mode2, which applies Defender exclusions and performs injection through PowerShell.
Remote control and theft follow
Three payloads give the attackers different ways to use an infected PC. For remote access, the malware launches two identical instances of the AsyncRAT backdoor on separate ports. Doctor Web’s findings suggest this probably enables two operators to control the same computer.
A clipper targets cryptocurrency transactions by substituting wallet addresses in the clipboard; it also captures screenshots. A separate stealer gathers browser data, configuration files for FileZilla, MobaXterm and Total Commander, VPN settings, messenger files, game accounts and Discord tokens. Stolen material is packaged into ZIP archives and transferred through Telegram.
The malware further interferes with security software by changing the hosts file to block antivirus vendors’ domains.
Doctor Web also found signs of continuing development. Unused routines could fetch and extract Lodge.7z, an archive containing an unfinished Electron project whose executable is named WUDFHost.exe. The code points to prospective functions for installing itself as a system service, restoring Microsoft.exe after deletion, controlling startup and installing updates.
For blockchain game enthusiasts and security practitioners downloading these projects, Doctor Web recommends keeping antivirus software current and scanning every downloaded file.
