Security researchers at Doctor Web (Dr.Web) say a campaign that began about two years ago, first aimed at crypto-wallet users and gamers, has switched to people who work in information security. The attackers publish GitHub repositories that look like tools for scan automation, security testing and log analysis; one example advertised a script to parse, clean and format output from the Fscan network scanner. Dr.Web says more than 2,000 PCs were infected when it investigated.
The malicious code is hidden in the project files. Dr.Web found it in Visual Studio project files, where a pre-build routine runs it before compilation, and in Python and Go source files, where it sits behind long stretches of whitespace so it is not visible on screen. The code runs a PowerShell script that fetches an encrypted download link and then a loader named Microsoft.exe. Dr.Web says the loader gains persistence and higher privileges, turns off Windows Defender, UAC, System Restore and shadow-copy protections, and injects the final payloads into legitimate processes.
The payloads are the AsyncRAT remote-access backdoor, a clipper that swaps crypto wallet addresses on the clipboard, and an infostealer that takes browser data, VPN settings, FTP client configuration, gaming account data and Discord tokens and sends them out through a Telegram bot. Dr.Web also says the loader tries to remove ESET, McAfee and Malwarebytes software. It lists techniques the loader uses to avoid detection, including disabling Smart App Control through a registry change and patching Windows tracing and AMSI scanning in memory.
How to check if you’re affected
Affected devices are Windows PCs where someone cloned and built (or ran) one of these repositories, especially Visual Studio projects or Python and Go scripts from unfamiliar GitHub accounts.
- Dr.Web gives these indicators: the folder
C:\ProgramData\Windows.Microsoft.Photos, PowerShell scripts atC:\Users\Public\Pictures\t.ps1andL.ps1, and the domains muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com and muckdeveloper[.]com plus the IP address 130.12.182[.]172. Dr.Web also published a full indicator list, linked below. - Dr.Web’s advice is to keep antivirus databases current and scan files downloaded from the internet; it says its own products detect the malware as Trojan.Loader.3261, Trojan.Clipper.688 and JS.Stealer.191. It did not give removal steps in the article we read.
- If you find these indicators, our suggestion (not from Dr.Web) is to treat passwords, browser sessions and any wallet used on that PC as exposed and change them from a clean device.