1. Basic Information

2. Executive Summary

Visual Studio build hooks and source code embedded in fake security projects launched PowerShell and an Electron loader to deploy AsyncRAT, clippers, and stealers. Doctor Web reported over 2,000 infections during its investigation, though the breakdown of infections originating from security projects has not been published.

3. Attack Flow

  1. A victim clones a GitHub repository disguised as a security scanner, testing tool, or log analyzer, and then opens the project, builds it, or executes the source code.
  2. PreBuildEvent entries in .csproj files, PowerShell scripts within .suo files, or Python and Go code hidden with whitespace launch PowerShell.
  3. PowerShell decrypts an encrypted download URL, retrieves Quixo.7z, and extracts it to C:\ProgramData\Windows.Microsoft.Photos.
  4. An Electron-based executable named Microsoft.exe attempts privilege escalation, persistence, and evasion of security controls such as Windows Defender, UAC, ETW, and AMSI, while injecting payloads into RegAsm.exe, dwwin.exe, and dwm.exe.
  5. AsyncRAT, a clipper, and a JavaScript stealer perform remote control, replace cryptocurrency addresses, steal data from browsers, VPNs, FTP clients, and Discord, and transmit the data to a Telegram bot.

4. Attacker Positioning and Prerequisites

  • The attacker is a remote actor capable of preparing a malicious GitHub repository and an external download location.
  • The victim must open the project, build it, or execute the source code.

5. Observer Perspective

Victim Perspective

  • After acquiring the security tool, PowerShell or an Electron application launches, which can lead to account and cryptocurrency wallet compromise as well as the termination of security products.

Administrator Perspective

  • Indicators of compromise include t.ps1 or L.ps1 scripts, the Windows.Microsoft.Photos directory, Microsoft.exe, process injection into legitimate processes, Windows Defender exclusions, ETW and AMSI patches, and modified hosts files.

6. Success and Failure Conditions

Success Conditions

  • The user opens, builds, or executes an unverified repository.
  • PowerShell execution, external network communication, archive extraction, and payload execution are permitted.

Failure Conditions and Mitigations

  • Review the origin and content of code, and prevent suspicious code from executing. Application allowlisting should be applied with configurations that block scripts and related execution paths.
  • Restricting PowerShell execution and blocking Telegram communications act as effective measures against the transmission path to disrupt subsequent stages.
  • Blocking changes to Windows Defender settings is effective against that specific defense evasion. Because the loader also includes persistence mechanisms operating under standard user privileges, preventing changes to Defender settings alone does not stop the entire infection chain.

7. Outcomes upon Success

  • Remote access, credential and session theft, cryptocurrency address substitution, security control disabling, and recovery interference become possible.

8. Observable Logs

  • Email: No email vectors specific to this campaign have been confirmed.
  • Proxy/SWG/DNS: Verify suspicious communications to public IOCs such as muckanthropic[.]com, Pastebin, and Telegram.
  • Endpoint/EDR: Detect PowerShell launched from an IDE, archive extraction, Microsoft.exe, process injection, and changes to defense settings.
  • Identity/IdP: Correlate available authentication and session logs from IdPs, VPNs, and various services with the compromise timestamp. The theft of local data and token abuse cannot be confirmed using IdP logs alone.
  • SaaS/Cloud: Preserve GitHub repository URLs, commit SHAs, and clone timestamps.
  • Network: Verify C2 and Telegram communications originating from PowerShell, Electron, and injected processes.

9. Assessment of Successful Attack

Malware Execution or Authentication Success Confirmed

  • Public Information: Doctor Web reported over 2,000 infections during its investigation. While analysis confirmed the capabilities of remote access, clippers, and stealers, the breakdown of infections originating from security projects and the actual execution of theft or remote control on individual endpoints remain unknown.
  • Scope: Limited to the repositories, samples, and telemetry analyzed by Doctor Web. The breakdown of infection counts originating from security projects has not been published.

Organizational Assessment Criteria

  • Differentiate between cloning, the initial trigger, the loader, payload execution, data collection, and exfiltration.

10. Investigation Playbook

  • Trigger: Start from unauthorized repository execution, PowerShell launched from an IDE, or unfamiliar Electron applications.
  • Initial Verification: Confirm repository URLs and commits, opened files, build timestamps, and user privileges.
  • Endpoint: Preserve PowerShell artifacts, process trees, memory injection evidence, defense setting modifications, and archives.
  • Identity and Cloud: Check sessions related to browsers, VPNs, FTP clients, Discord, and cryptocurrency wallets.
  • Subsequent Actions: Investigate Telegram exfiltration, AsyncRAT operations, clipboard replacement, and additional payloads.
  • Containment: Isolate endpoints, preserve evidence before rebuilding, and revoke credentials and tokens.
  • Decision Categories: Separate cloning, triggers, loaders, payloads, collection, and exfiltration.

11. Defense and Detection Ideas

  • Single Event: Detect PowerShell launched from an IDE or source process.
  • Timeline Correlation: Correlate cloning, project opening, PowerShell execution, archive handling, loader activity, injection, and Telegram communications.
  • Hunting: Search for public IOCs, t.ps1 and L.ps1 scripts, Nexara.7z, Windows.Microsoft.Photos, and Windows Defender exclusions.
  • Log Gaps: Repository names and IOCs can be modified; relying solely on known values will not cover variant strains.
  • Priority Controls: Prioritize source code review, IDE child-process monitoring, application control, and credential isolation.

12. Facts, Inference, and Hypothesis

Facts

  • Doctor Web identified GitHub repositories containing malicious code embedded in .csproj files, .suo files, and Python and Go scripts.
  • The loader implements features to disable Windows Defender, UAC, System Restore, and VSS, add Defender exclusions, patch ETW and AMSI, perform Ntdll unhooking, and execute techniques such as Halo's Gate.
  • The payloads consist of AsyncRAT, a clipper, and a stealer targeting data from browsers, VPNs, FTP clients, Discord, and other applications.
  • Doctor Web reported over 2,000 infections in its investigation. The breakdown of infections via security projects and the execution of theft or remote control on individual endpoints remain unknown.

Inference

  • Because development endpoints handle source code, credentials, and VPN connections simultaneously, the impact radius of subsequent compromises can be wider than that of standard user endpoints.

Hypothesis

No additional hypotheses. Unverified items are listed in the Unresolved Questions and Further Investigation section.

13. MITRE ATT&CK Mappings

ID Technique Confidence Basis
T1204.002 User Execution: Malicious File high Initial code executes when a fake project is opened, built, or run.
T1059.001 Command and Scripting Interpreter: PowerShell high PowerShell is launched from the project or source code.
T1055 Process Injection high Payloads are injected into legitimate Windows processes.
T1562.001 Impair Defenses high Interferes with Windows Defender, ETW, AMSI, and other controls.
T1567 Exfiltration Over Web Service high Collected data is transmitted to a Telegram bot. The Telegram Bot API represents exfiltration via a web service, and there is no evidence that the same C2 channel is used.

14. Unresolved Questions and Further Investigation

  • The total number of malicious repositories, regional and organizational breakdowns of victims, and all C2 servers and hashes cannot be definitively determined from public information alone.

15. Impact on SOCs and Organizations

Developers and security analysts who acquire security tools or PoCs are targets of attacks. Instead of trusting repositories based on appearance alone, organizations must monitor build hooks, IDE child processes, and credential boundaries on development workstations.

16. Summary by Role

  • For SOCs: Monitor the chain of IDE execution leading to PowerShell, archive extraction, Electron loaders, process injection, and Telegram activity.
  • For Administrators: Isolate and review unauthorized repositories, and separate credentials and VPN privileges on development workstations.
  • For Users: Even for security tools on GitHub, verify build hooks and source code before opening projects.