general
292 Fake GitHub Repos Are Handing Out Infostealers
2026-07-15
A threat actor spent the middle of the year quietly filling GitHub with 292 repositories dressed up as legitimate software. Security tools, crypto wallets, developer utilities, macOS apps, secure email clients, games. If people were searching for it, someone had built a convincing fake of it.
Arctic Wolf caught the campaign after one of its own products showed up as bait on 26 June. Each repo came with a polished README, a download button labelled Secure Content, and spoofed trust badges linking off to a landing page that changed its branding on the fly.
One template, hundreds of disguises
The clever bit is how little effort the operator actually put in. A single templated HTML page rendered whichever brand the URL asked for. Hyphens became spaces, title case was applied automatically, logos swapped in from a lookup. One page, hundreds of convincing product sites. Cheap to run, endlessly reusable, and near-invisible to anyone scanning for exact-match phishing kits.
The download itself is a ZIP file that gets renamed roughly every minute, which is enough to defeat naive hash-based blocking. Inside sits a legitimate, signed WinGUP updater alongside a trojanised libcurl.dll. Running the executable causes it to side-load the malicious DLL, which decodes an infostealer and runs it directly in memory.
What the malware actually does
The payload is a variant of BoryptGrab, and it is not subtle. It pulls data from:
- 19 different browsers
- 32 crypto wallets
- A range of messaging and social apps
Everything gets bundled up and shipped to a server in Russia. Notably, this build can bypass Chrome's App-Bound Encryption by injecting directly into the browser process, which is the mechanism Google introduced specifically to stop this kind of theft.
What it does not do is stick around. No persistence, no anti-analysis tricks, no attempt to hide its tracks in the temp directory. The operator is not trying to live on the machine. They are trying to empty the drawers before anyone realises they came in.
The assumption the whole thing rests on
GitHub has taken most of the repositories down, though a handful of GitHub Pages redirectors were still live when Arctic Wolf published its findings. Expect the same operator, or a copycat, to rebuild the network under fresh accounts within weeks. The infrastructure is disposable by design.
What is worth sitting with is how the campaign works at a human level. It does not exploit a vulnerability in GitHub. It does not rely on a zero-day. It relies on the fact that a lot of people, when they need a piece of paid software and see a free copy in a search result, will click download without checking who owns the repository, how old the account is, or whether the project has any real history behind it.
GitHub is not the problem. The assumption is. And that assumption is what makes campaigns like this cheap enough to run at 292 repos a pop.