Fake 'Security Tools' on GitHub Hunt the Defenders: Padded-Whitespace Payloads Drop AsyncRAT, a Clipper and a Stealer on 2,000+ Hosts

High · 2026-11-09 · By H.A

A two-year-old operation now baits security professionals with GitHub repos posing as scanners and log parsers, hiding a loader after long whitespace and in pre-build events that drops AsyncRAT, a crypto clipper and an infostealer.

Overview

A malware operation that has been running for about two years is now aiming at security professionals. It publishes GitHub repositories that pose as scanning, testing and log-analysis utilities. Researchers who analysed the campaign say more than 2,000 Windows systems have been compromised so far.

Developers who clone and run one of these repositories, or simply build it in Visual Studio, start a multi-stage infection. It ends with the AsyncRAT backdoor, a cryptocurrency clipper and an information stealer that sends its data out through a Telegram bot.

What is new: the operators started with crypto-wallet holders and gamers, using fake blockchain games, Telegram clicker bots and cheats. They have since moved on to the people who defend networks. Pentesters and SOC analysts often run untrusted tools on machines that hold credentials, VPN profiles and client data.

The Campaign

The repositories look like ordinary helper projects. One example is a script that claims to parse, clean and format output from the Fscan network scanner (published as "FscanOutput-Beautify"). Others pose as FRP configuration panels, IP-login log controllers and crypto-payment APIs.

The malicious code is hidden in plain sight:

• Whitespace padding: the payload sits after long runs of spaces in Visual Studio project files, Python scripts and Go source files. It is off-screen in most editors and in GitHub's web view unless you scroll horizontally.
• Pre-build events: in some Visual Studio projects a pre-build event runs the hidden command before compilation, so building the project is enough.
• Trusted platforms for delivery: download links and configuration are fetched from Pastebin, Telegram channels, GitCode, GitHub releases, Google Docs and YouTube video descriptions.

Infection Chain

1. A PowerShell one-liner retrieves an encrypted download link.
2. The link delivers a modular Electron-based loader, usually named Microsoft.exe (variants also use SearchFilterHost.exe and WUDFHost.exe).
3. The loader sets up persistence, elevates privileges, disables Windows security and recovery features, and injects the next stage into legitimate processes.
4. Its default "Mode3" evasion spoofs explorer.exe as the parent process, turns off Smart App Control through a registry value, reloads a clean ntdll.dll to strip security hooks, uses direct system calls, and patches EtwEventWrite and AmsiScanBuffer in memory.
5. A fallback "Mode2" adds Microsoft Defender exclusions and uses PowerShell to decrypt payloads and inject them into RegAsm.exe.

The malware also tries to uninstall ESET, McAfee and Malwarebytes, block their update servers, and interfere with Windows backups. Researchers also found an unfinished watchdog component meant to re-download the loader if it is removed.

Payloads

• AsyncRAT: full remote control of the workstation.
• Clipper: replaces cryptocurrency wallet addresses copied to the clipboard.
• Stealer: collects browser data, VPN settings, FTP client configurations, gaming accounts and Discord tokens, then exfiltrates them through Telegram.

Indicators of Compromise

Domains and IPs:

muckanthropic[.]com
muckcoding[.]com
muckdeveloper[.]com
muckduck.duckdns[.]org
130.12.182[.]172
130.12.182[.]209

Payload paths and archives: /LG/Nexara, /LG/Lodge, /LG/MicrosoftCur, /LG/Api-Certificate, Nexara.7z, Lodge.7z, Quixo.7z.

File names: Microsoft.exe, app.asar, led.dll, FscanOutput_v2.2.py, t.ps1, L.ps1.

Example malicious repository names: FscanOutput-Beautify, Frp-Quick-Configuration-Panel, SharpUserIP-login-logs-controller, sleep-duck-eye, plus several "Crypto-Game-Token-Api" and "Auto-Farm-Clicker-Cheat" projects.

The researchers' published IOC set also contains SHA-1 hashes for the trojanised .suo, .csproj and resource.go files.

Detection

• Hunt for devenv.exe or MSBuild.exe spawning powershell.exe, cmd.exe or curl.exe. That is pre-build event abuse.
• Alert on any process named Microsoft.exe running from user-writable paths, and on Electron app.asar bundles outside Program Files.
• Watch for new Defender exclusions, changes to Smart App Control registry values, and RegAsm.exe with network connections.
• Look for DNS queries to the domains above and to api.telegram.org from developer workstations.
• Scan cloned repositories for very long lines:

# flag source/project files with lines longer than 500 characters
grep -rnE '.{500,}' --include='*.csproj' --include='*.vcxproj' --include='*.py' --include='*.go' --include='*.sln' . | cut -c1-200

# list pre-build / post-build events in Visual Studio projects
Get-ChildItem -Recurse -Include *.csproj,*.vcxproj | Select-String -Pattern 'PreBuildEvent|PostBuildEvent|Exec Command'

Recommended Actions

• Open and build unknown repositories only in disposable VMs or sandboxes without saved credentials or VPN profiles.
• Before building, check project files for build events and turn on word wrap in your editor to expose padded payloads.
• Prefer tools from their official upstream project. Be suspicious of new accounts, inflated stars and repositories whose README points to Pastebin or Telegram downloads.
• If you ran one of these projects, treat the host as compromised: rebuild it, and rotate browser-saved passwords, VPN and FTP credentials, Discord tokens and any wallets used on it.
• Block the listed infrastructure at DNS and proxy level.

Analyst Assessment

The campaign is not technically new. AsyncRAT and clippers are commodity tools. But the pivot to security professionals matters. Analysts routinely pull small helper scripts from GitHub to process scanner output, and their machines often hold client credentials and engagement data. The whitespace and build-event tricks defeat a quick visual review, which is often the only review such tools get. Expect more fake "offensive tooling" repositories. Organisations should treat third-party security scripts as untrusted code, just like any other dependency.