An internal security team discovered a GitHub impersonation campaign targeting customers and the public by creating fake repositories that mimicked reputable cybersecurity vendors. These repositories contained non-malicious content but included disguised links that led users to download ZIP archives with malicious executables. The attack chain deployed BoryptGrab Stealer malware using DLL side-loading techniques. Approximately 300 similar repositories impersonated organizations such as Malwarebytes, Bitdefender, and 360 Total Security, leveraging SEO poisoning to increase victim exposure. The malicious pages have since been removed and detection mechanisms enhanced.

Victims who followed the disguised links downloaded and executed malware that steals sensitive information via DLL side-loading. The campaign potentially exposed users to credential theft and data compromise. The widespread impersonation of trusted vendors increased the risk of victimization through social engineering and SEO poisoning.

The malicious GitHub pages have been removed, and detection capabilities have been enhanced. Users should avoid downloading executables from untrusted or suspicious repositories, verify the authenticity of vendor pages, and maintain updated endpoint protection. No official patch or fix applies as this is a social engineering and malware distribution campaign rather than a software vulnerability.