Operation Muck and Load is a malware campaign involving 222 GitHub repositories across 190 accounts that distribute a malicious Go module. This module masquerades as a DNS/subdomain scanning tool but executes hidden PowerShell commands that fetch encrypted payloads from public dead-drop locations such as Pastebin, YouTube, Instagram, Telegram, Google Docs, and GitCode. The payloads include various Windows malware families like AsyncRAT, Quasar RAT, Remcos-style RAT, Vidar infostealer, trojan loaders, spyware, and Monero cryptominers. The threat actor uses GitHub Actions workflows to generate numerous timestamped commits, resulting in over 1,200 published versions, 700 of which are malicious. The malware execution chain decrypts and extracts password-protected archives to run the final payloads, employing multiple mirrored sources for resilience. Some repositories embed malware directly in source trees or release assets. The campaign is linked to prior activity associated with the 'ischhfd83' email address and Muck-themed domains.

The campaign enables widespread distribution of various Windows malware types, including remote access trojans, infostealers, spyware, trojan downloaders, and cryptominers. This can lead to unauthorized access, data theft, system compromise, and resource abuse on infected Windows systems. The use of public dead-drop locations and multiple mirrored payload sources increases the campaign's resilience and complicates detection and takedown efforts. The large number of malicious Go module versions increases the risk of infection for users who download or depend on these repositories or modules.

No official patch or remediation is applicable as this is a malware campaign leveraging public GitHub repositories and open source modules. Organizations and developers should avoid using or downloading Go modules from untrusted or suspicious GitHub repositories, especially those masquerading as legitimate tools. Security teams should monitor for the presence of the described malicious Go modules and PowerShell execution patterns in their environments. GitHub repository owners should review and remove any compromised repositories. Users should apply standard endpoint protection and malware detection controls to identify and block the described malware families. Since this is not a vulnerability in software but a malware distribution campaign, vendor patching does not apply.