Nearly 300 GitHub repos pose as legit software to push malware
A threat actor has created nearly 300 fake GitHub repositories impersonating legitimate software and security projects to distribute an infostealer malware variant called BoryptGrab. These repositories lure users by mimicking trusted brands and providing malicious download links. The malware steals sensitive data from browsers, cryptocurrency wallets, messaging apps, and system files, then exfiltrates it to a Russia-based command-and-control server. The campaign was detected by Arctic Wolf, which found that GitHub removed many malicious repos but some remain active. The malware does not persist on infected hosts and leaves forensic evidence behind.
AI Analysis
Technical Summary
The threat involves a large-scale campaign where a threat actor published 292 fake GitHub repositories impersonating legitimate software brands to distribute a trojanized payload delivering a variant of the BoryptGrab infostealer malware. The malicious landing pages use templated HTML/JS to spoof branding and deliver a ZIP archive containing a trojanized libcurl.dll and a signed WinGUP updater executable. When executed, the malware side-loads the DLL, which runs an infostealer in memory that targets data from 19 web browsers, 32 cryptocurrency wallets, messaging apps (Telegram, Discord, Steam, Meta’s Max), Windows Credential Manager, and sensitive files. The malware bypasses Chrome’s App-Bound Encryption via code injection and exfiltrates compressed stolen data to a Russia-based C2 server. The malware does not establish persistence and leaves forensic artifacts. GitHub has removed many repositories, but some redirectors remain active. The operator is likely Russian-speaking and financially motivated.
Potential Impact
The malware steals a wide range of sensitive information including passwords, cookies, payment data, cryptocurrency wallet contents, messaging app sessions, Windows credentials, and sensitive files. This can lead to account compromise, financial theft, privacy breaches, and further system compromise. The campaign’s scale and use of trusted brand impersonation increase the risk of successful infections. The malware’s ability to bypass Chrome’s App-Bound Encryption enhances its data theft capabilities. However, it does not persist on the system, limiting long-term control by the attacker.
Mitigation Recommendations
GitHub has removed a large portion of the malicious repositories, though some redirectors remain active. Users should avoid downloading software from unofficial or suspicious GitHub repositories and verify authenticity before downloading. Security teams can use the Yara rules and IoCs shared by Arctic Wolf to detect this malware activity. Since the malware does not persist, infected systems can be remediated by removing the malware and changing compromised credentials. No official patch is applicable as this is a malware campaign rather than a software vulnerability.
Nearly 300 GitHub repos pose as legit software to push malware
Description
A threat actor has created nearly 300 fake GitHub repositories impersonating legitimate software and security projects to distribute an infostealer malware variant called BoryptGrab. These repositories lure users by mimicking trusted brands and providing malicious download links. The malware steals sensitive data from browsers, cryptocurrency wallets, messaging apps, and system files, then exfiltrates it to a Russia-based command-and-control server. The campaign was detected by Arctic Wolf, which found that GitHub removed many malicious repos but some remain active. The malware does not persist on infected hosts and leaves forensic evidence behind.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The threat involves a large-scale campaign where a threat actor published 292 fake GitHub repositories impersonating legitimate software brands to distribute a trojanized payload delivering a variant of the BoryptGrab infostealer malware. The malicious landing pages use templated HTML/JS to spoof branding and deliver a ZIP archive containing a trojanized libcurl.dll and a signed WinGUP updater executable. When executed, the malware side-loads the DLL, which runs an infostealer in memory that targets data from 19 web browsers, 32 cryptocurrency wallets, messaging apps (Telegram, Discord, Steam, Meta’s Max), Windows Credential Manager, and sensitive files. The malware bypasses Chrome’s App-Bound Encryption via code injection and exfiltrates compressed stolen data to a Russia-based C2 server. The malware does not establish persistence and leaves forensic artifacts. GitHub has removed many repositories, but some redirectors remain active. The operator is likely Russian-speaking and financially motivated.
Potential Impact
The malware steals a wide range of sensitive information including passwords, cookies, payment data, cryptocurrency wallet contents, messaging app sessions, Windows credentials, and sensitive files. This can lead to account compromise, financial theft, privacy breaches, and further system compromise. The campaign’s scale and use of trusted brand impersonation increase the risk of successful infections. The malware’s ability to bypass Chrome’s App-Bound Encryption enhances its data theft capabilities. However, it does not persist on the system, limiting long-term control by the attacker.
Mitigation Recommendations
GitHub has removed a large portion of the malicious repositories, though some redirectors remain active. Users should avoid downloading software from unofficial or suspicious GitHub repositories and verify authenticity before downloading. Security teams can use the Yara rules and IoCs shared by Arctic Wolf to detect this malware activity. Since the malware does not persist, infected systems can be remediated by removing the malware and changing compromised credentials. No official patch is applicable as this is a malware campaign rather than a software vulnerability.
Technical Details
- Article Source
- {"url":"https://www.bleepingcomputer.com/news/security/nearly-300-github-repos-pose-as-legit-software-to-push-malware/","fetched":true,"fetchedAt":"2026-07-14T19:17:34.522Z","wordCount":912}
Threat ID: 6a568b4e68715ace430e4081
Added to database: 07/14/2026, 19:17:34 UTC
Last enriched: 07/14/2026, 19:17:50 UTC
Last updated: 07/15/2026, 03:44:18 UTC
Views: 23
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.