Trojan.Loader.3261: fake GitHub security tools infect 2,000+ Windows PCs, Dr.Web says

Security researchers are now a target of a malware campaign that hides in fake GitHub projects. Doctor Web (Dr.Web) reports that Trojan.Loader.3261, an Electron-based loader delivered through trojanised Visual Studio, Python and Go projects, had infected more than 2,000 PCs when it studied the campaign, and that the lures have moved from blockchain game bots and cheats to scanning automation, security testing and log analysis tools. The payload is a remote access trojan, a clipboard hijacker that swaps crypto wallet addresses, and an infostealer.

Key points

• Dr.Web reports malicious GitHub repositories whose Visual Studio, Python and Go files contain hidden code; at the time of its research more than 2,000 PCs were infected (Dr.Web, 5 November 2026).
• The first infected repositories appeared about two years ago, aimed at crypto wallet users through blockchain game, bot and cheat projects; the lures have now shifted to tools for information security professionals.
• In Visual Studio projects, a PreBuildEvent in the .csproj file runs the malicious code before the project compiles, and the .suo files contain a PowerShell command; in .py and .go files the code is hidden behind a large number of whitespace characters.
• The final stage includes two AsyncRAT backdoor instances, a clipper that replaces crypto wallet addresses, and an infostealer (JS.Stealer.191) that sends data through a Telegram bot.
• The loader disables or weakens Windows protections and attempts to remove McAfee, ESET and Malwarebytes.

What to do

Who is affected: Windows users who cloned and built or ran code from a repository that matches this description, especially lookalike tools for network scanning, security testing, log analysis, or blockchain game bots. Dr.Web's report is about Windows systems.

1. Do not build or run unvetted repositories on a machine that holds real credentials. Use a disposable virtual machine for tools you have not reviewed. This is our advice, not Dr.Web's.
2. Read project files before opening them. In Visual Studio projects, look in .csproj for a PreBuildEvent, and check .suo files. In .py and .go files, look for lines with very long runs of whitespace that push code off screen.
3. Check for the artefacts Dr.Web names. Files C:\Users\Public\Pictures\t.ps1 and L.ps1; a folder C:\ProgramData\Windows.Microsoft.Photos holding Microsoft.exe; and unexpected Microsoft Defender exclusions for regasm.exe and dwm.exe.
4. Compare against the indicators. Dr.Web lists these addresses (defanged here): muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com, muckdeveloper[.]com and 130.12.182[.]172. BleepingComputer points to a Dr.Web repository of indicators of compromise (github.com/DoctorWebLtd/malware-iocs).
5. If you find a match, treat the machine as compromised. Rebuild it, and from a clean device rotate browser-stored passwords, VPN settings, FTP and SSH client credentials, Discord tokens and gaming accounts, and move any crypto held on that machine. The stealer's target list below shows what to rotate.

What happened

Dr.Web's malware analysts found the infected repositories and published their findings on 5 November 2026; BleepingComputer reported the research the following day. The company says the first infected repositories appeared about two years ago. They carried Visual Studio projects related to blockchain games, game bots and cheats, and one example it shows is a repository for the Telegram-based platform Catizen. The attackers even supplied instructions for installing Visual Studio and cloning the repository, to catch users with little IT background.

The campaign has since turned to a more technical audience. Dr.Web says the malware now sits in projects related to scanning automation, security system testing and log analysis, and shows a bogus repository containing a script that claims to parse, clean and format Fscan output. Fscan is a network scanning tool; the bogus repository is a lookalike helper, and the article does not name it. Dr.Web calls the move to security professionals the most intriguing part.

Background

Repositories like these rely on a habit rather than a vulnerability. Developers and defenders routinely clone small utilities from GitHub and open them in an IDE with their own privileges, on machines that hold credentials. A Visual Studio PreBuildEvent runs commands as part of building the project, so opening and building an untrusted solution is, in effect, running its author's code. That is why hiding the trigger in project metadata and behind whitespace works against people who skim the source.

We have been covering other supply chain and tooling risks this week, including how to audit the plugins, hooks and MCP servers your AI coding agent loads. The shared lesson is that code you did not write runs with your permissions the moment you open or build it.

How it works

Per Dr.Web, the infection runs in stages.

Stage 1: the trigger. Once an infected file is opened or built, a PowerShell script runs, with paths such as C:\Users\Public\Pictures\t.ps1 and L.ps1. It can query the attackers' servers and legitimate platforms, including YouTube, Telegram, Google Docs, GitCode and Pastebin, to fetch an encrypted string. Decrypting it yields a download link for an archive that is saved from the attackers' servers or GitHub and unpacked to C:\ProgramData\Windows.Microsoft.Photos.

Stage 2: the loader. The archive contains an application built with the Electron framework, Microsoft.exe, which Dr.Web detects as Trojan.Loader.3261 (version 1.4.5 at the time of writing). It sends system information to the attackers through a Telegram bot, makes sure it restarts automatically, raises its privileges, disables Windows Defender, UAC, notifications, System Restore and VSS, adds Defender exclusions, modifies the hosts file, and removes McAfee, ESET and Malwarebytes.

Stage 3: evasion modes. Dr.Web describes four deployment modes. The default, Mode3, uses parent process spoofing so that explorer.exe appears as the parent, changes the VerifiedAndReputablePolicyState registry value to bypass Smart App Control, removes EDR hooks by restoring ntdll.dll code from disk, makes direct system calls using a technique it calls Halo's Gate, patches EtwEventWrite to stop Event Tracing for Windows logging, and patches AmsiScanBuffer to blind script scanning. It then injects into RegAsm.exe, dwwin.exe or dwm.exe. Mode2 is a fallback that adds Defender exclusions for regasm.exe and dwm.exe and injects through a PowerShell script. Dr.Web also names Mode3non and a "handler" mode, the latter possibly a legacy method.

Stage 4: the payloads. Two copies of BackDoor.AsyncRAT.115 give full access; they differ only in network ports, which Dr.Web says would let two operators control one device at once. Trojan.InjectNET.14 injects Trojan.Clipper.688 into regasm.exe to swap crypto wallet addresses in the clipboard, and sends screenshots plus the active window title, user login and IP address to a Telegram bot. JS.Stealer.191, another Electron application, checks for sandboxes and virtual machines and then steals browser data, FileZilla XML files, MobaXterm.ini, Total Commander's wcx_ftp.ini, VPN settings, messenger files, video game account information, game platform account data and Discord tokens, and sends them out through Telegram.

What it means

For defenders, the uncomfortable point is that the usual audience for these tools, people who know better, is the target. A researcher's workstation often holds VPN profiles, SSH and FTP credentials and cloud tokens; the stealer's target list includes exactly those kinds of files. Treat third-party scripts on a defender's laptop with the same suspicion as an email attachment.

For GitHub users generally, a project's stars, tidy README and installation instructions say nothing about its safety. The attackers wrote step-by-step guidance for non-experts, which is also a reminder that these lures are written to be followed.

For security vendors, the loader's focus on removing McAfee, ESET and Malwarebytes and on disabling Defender, ETW and AMSI means that endpoint protection alone is a weak last line against a user who runs the code themselves.

What we don't know yet

• How the attackers get victims to the repositories, and how many repositories exist. Dr.Web shows examples and does not give a count.
• Who is behind the campaign. Dr.Web's report, as we read it, does not attribute it.
• How the 2,000 infections break down by the two audiences, gamers and security professionals.
• Whether GitHub has removed the repositories. We did not find a statement.

What to watch next

Watch Dr.Web's indicator repository (linked by BleepingComputer) for new hashes and domains, and GitHub's response on the repositories. Teams that keep security tooling on shared analysis machines should consider a policy of vetting and sandboxing any new utility before it touches a machine with credentials.

Sources

• Primary: Dr.Web, "Insolence beyond belief. Threat actors target information security developers on GitHub" (5 November 2026)
• BleepingComputer, "Fake security tools on GitHub push backdoors and infostealers"
• Dr.Web indicators of compromise on GitHub