Security researchers at ArcticWolf have identified 292 fake GitHub repositories set up by criminals to spread a password-stealing program. The fake repos were carefully crafted to look like legitimate, well-known software: the campaign targeted people searching for security tools, cryptocurrency wallets, financial apps, macOS utilities, and gaming software. Each fake repository had a professional-looking description and a download link in the README file — the first thing most people read when they find a GitHub project. Clicking the download link led to an archive containing a hidden piece of malware.
The malware uses a well-known technique called DLL side-loading: it bundles a legitimate, digitally signed program alongside a secretly malicious file. When you run the legitimate program, it automatically loads the malicious file in memory — so no suspicious executable ever appears on your system. The payload is a variant of a known password stealer called BoryptGrab, which silently sweeps through your computer looking for data to exfiltrate. It targets passwords and cookies saved in 19 different web browsers, credentials stored in 32 cryptocurrency wallet applications, and account data from messaging apps and social media tools. Everything it finds is sent to the attackers’ servers before you notice anything is wrong.
How to check if you’re affected
Affected products include any software you downloaded from GitHub after searching for tools or utilities in the past several weeks, particularly in these categories: crypto wallets, security scanners, trading tools, or macOS productivity apps. If you downloaded and ran a program from a GitHub repository you found via a web search (rather than a trusted, well-known project you’ve used before), review what that app was and where you found it. Run a scan with an up-to-date antivirus or security tool to check for any infections. If you suspect a machine was compromised, change all browser-saved passwords and revoke any cryptocurrency wallet keys that were stored on that device.