Fake GitHub Pages Impersonate 292 Real Brands to Push Password-Stealing Malware

Key points

• Arctic Wolf found 292 fake GitHub repositories built to impersonate real security, crypto and developer software, with the campaign starting on 26 June.
• The malware steals data from more than 19 web browsers, 32 cryptocurrency wallets, Telegram, Discord, Steam and Meta's Max messenger.
• The stealer, a variant of the BoryptGrab family, can bypass Google Chrome's App-Bound Encryption by injecting code straight into the browser.
• Stolen data is packaged and sent to a command server based in Russia.
• GitHub has taken down most of the fake pages, but several dozen redirector pages remained live at the time of reporting.

A financially motivated crew, likely Russian-speaking, spent the summer flooding GitHub with fake project pages that looked like the real thing. Anyone searching for a well-known security tool or a crypto wallet risked landing on one.

GitHub is the world's biggest home for software source code. Companies and hobbyists alike publish their projects there, which is exactly why criminals squat on it. A page ending in github.io looks legitimate at a glance. We reported on 10 July that a separate operation called Muck and Load had built 222 phoney repositories to trick developers into downloading password-stealing programs; this campaign is bigger and broader in who it targets.

Arctic Wolf mapped the activity after noticing one of its own products being impersonated. Researchers counted 292 fake repositories, each with a README file pointing to a download page. The story was first reported by BleepingComputer.

How did people end up downloading it?

Visitors saw a button labelled "Download Secure Content" and fake trust badges implying the file had been scanned and approved. Search results did the rest, pulling in traffic from people hunting for free copies of paid software.

All pages were generated from a single template. The URL parsed which brand to display, replacing hyphens with spaces and adjusting capitalisation, so one block of code could pose as dozens of different companies.

What the malware actually does

Clicking download produced a ZIP archive whose filename and contents rotated roughly every minute, making it harder for antivirus tools to match a fixed signature.

Inside were two files: a legitimate, properly signed updater called WinGUP and a booby-trapped file called libcurl.dll. Running the signed program automatically loaded the poisoned file beside it, a technique called DLL side-loading, which lets malicious code run under the cover of a trusted application. The infostealer then unpacked itself entirely in memory, never writing to disk as a normal file.

The target list is wide. Saved passwords and payment details from more than 19 browsers, data from 32 cryptocurrency wallet brands, login sessions for Telegram, Discord and Steam, credentials for Meta's Max messenger, and the contents of Windows Credential Manager. Files on the Desktop and Documents folder with names hinting at passwords or wallet backups get swept up too, along with screenshots and a list of installed programs.

One detail stands out: this BoryptGrab variant carries a capability Arctic Wolf describes as previously undocumented. It defeats Chrome's App-Bound Encryption, the protection Google added to prevent other programs reading saved passwords, by injecting code directly into the running Chrome process. We first covered BoryptGrab on 14 July; the Chrome bypass is new.

The stolen bundle is then compressed and shipped to a server in Russia. The malware doesn't establish persistence, so victims may never notice they were hit.

Should ordinary users be worried?

Yes, if you search for free versions of paid software. The single-execution design means the passwords are gone before you've noticed anything wrong.

Anyone who downloaded a security tool or wallet app from an unfamiliar GitHub page since late June should change important passwords from a clean device, move any cryptocurrency to a fresh wallet, and sign out of all sessions on Telegram, Discord and Steam.

Arctic Wolf couldn't pin the campaign on a named group. GitHub has pulled most of the fake repositories, though several dozen redirector pages were still live when the report went out. The researchers shared a YARA detection rule and indicators of compromise for defenders who want to hunt for BoryptGrab activity in their environments.

The pattern here is worth watching: three separate GitHub-abuse campaigns have surfaced in the past ten weeks, each one leaning harder on the platform's reputation than the last.