Doctor Web has documented a campaign that hides AsyncRAT and an infostealer inside fake GitHub security tools aimed at the people who test your defenses, with more than 2,000 Windows systems infected so far. If your pentest supplier builds these helpers on the laptop holding your VPN profiles, their infection becomes your incident.
Key takeaways
- Doctor Web reports more than 2,000 Windows systems infected by fake GitHub security tools, including a bogus Fscan output parser.
- Some Visual Studio projects run the malware through a pre-build event, so compiling the project is enough.
- The Microsoft.exe Electron loader disables Windows defenses, then installs AsyncRAT, a crypto clipper and a Telegram infostealer.
- For regulated Cyprus firms, a compromised tester laptop is an assumed foothold and a possible NIS2 or DORA incident.
Why does a poisoned tester laptop reach your client data?
Because the machine a security professional uses to build tools often holds client access too: VPN profiles, browser sessions into cloud consoles, FTP configurations for file exchange and notes listing every weakness found so far.
The stealer in this campaign goes after that inventory: browser data, VPN settings, FTP client configuration files, gaming accounts and Discord tokens, sent out through a Telegram bot. Doctor Web has named no victim organizations, sectors or countries. No evidence places Cyprus firms among them, and none rules them out.
What changed when the lures became fake GitHub security tools?
The bait moved from games to the tester’s own toolbox. Per BleepingComputer’s 6 November 2026 report on Doctor Web’s research, the operation began about two years ago, around 2024, with blockchain games, bots and cheat tools aimed at crypto wallet holders. Recently the actor switched to repositories promising scan automation, security testing and log analysis.
One posed as a lightweight script to parse, clean and format output from the Fscan network scanner. Fscan itself is legitimate; the lure was the helper around it. Attackers took the same approach with the malicious Claude Code extension on Cursor: target the tools technical people install without a second look.
How does infection start before anyone runs the built tool?
Building the project is enough. The malicious code sat inside Visual Studio project files, Python scripts and Go source files, pushed out of view by long runs of whitespace so a quick scroll looks clean. In some Visual Studio projects it ran through a pre-build event, which executes commands before compilation starts.
That stage calls PowerShell, which retrieves an encrypted download link and fetches a modular Electron-based loader named Microsoft.exe. Doctor Web also found a still-in-development watchdog component meant to keep the loader alive and re-download it if deleted.
What does Microsoft.exe leave behind?
A remote access trojan, a clipboard hijacker and a stealer, installed after the loader sets up persistence, elevates privileges, disables Windows security and recovery features, and injects the next stage into legitimate processes. Its default Mode3 uses six evasion techniques:
- explorer.exe made to appear as the parent process;
- a registry change that disables Smart App Control;
- a clean ntdll.dll reloaded from disk to strip security-product hooks;
- direct system calls to avoid interception;
- an in-memory patch to EtwEventWrite that suppresses event tracing;
- an in-memory patch to AmsiScanBuffer that blinds script scanning.
If Mode3 fails, Mode2 adds Microsoft Defender exclusions and uses PowerShell to inject payloads into RegAsm.exe. The malware also tries to remove ESET, McAfee and Malwarebytes or cut them off from their update servers, and it interferes with Windows backups.
The payloads are AsyncRAT, an open-source RAT reused by many unrelated actors, a clipper that swaps crypto wallet addresses on the clipboard, and the Telegram stealer.
A note from standard incident-response practice, not from Doctor Web: AMSI and ETW patches blind the affected process, not the whole machine. Missing script logs after a suspected build do not prove a clean host; EDR telemetry and DNS or proxy records of Telegram bot API traffic still can.
What should a regulated firm require before the next test?
Treat a compromised supplier laptop as an attacker already inside your network. There is no CVE or patch; the defense is provenance and separation.
If anyone on your side or your supplier’s built one of these projects, rotate VPN, FTP and SSO credentials and revoke browser and Discord sessions from a clean device. With AsyncRAT present, assume everything reachable from the host was exposed.
For future engagements, write these controls into the statement of work:
- Tool provenance: third-party tools built only from known upstream projects, first in a disposable VM with no client credentials.
- Separation: engagement secrets on a dedicated machine, with client VPN access revoked when the engagement ends.
- Detection: endpoints checked against Doctor Web’s published indicators, plus hunting for Visual Studio or MSBuild spawning PowerShell, new Defender exclusions and RegAsm making network connections.
- Notification: the supplier tells you within hours, so you can meet the NIS2 24-hour early warning if the incident is significant. DORA entities classify it against the major-incident criteria.
When we run an assumed breach assessment from a single workstation, the fastest route to sensitive systems is rarely an exploit. It is a saved VPN profile or a cached SSO token. A compromised tester laptop gives an attacker the same head start.
FAQ
Are Cyprus companies named as victims of these fake GitHub security tools?
No. Doctor Web named no victim organizations, sectors or countries. Firms should check whether their staff or suppliers cloned matching repositories.
Does the malware run only if the tester executes the finished tool?
No. In some Visual Studio projects a pre-build event runs the code during compilation, before any binary exists.
Should an EMI or iGaming firm report a compromised pentest laptop under NIS2?
If the incident is significant, NIS2 requires an early warning within 24 hours and a notification within 72 hours, so contracts should oblige suppliers to report within hours.
Where can defenders get the indicators of compromise?
Doctor Web has published a complete IOC list in its advisory. Pull it from there rather than from shared tool repositories.
If your testing suppliers hold live access to your environment, our NIS2 compliance penetration testing covers what a compromised tester laptop would reach, and how quickly you would notice.