Fake GitHub security tools: building a “scanner” was enough to infect over 2,000 PCs
Your technician, developer or IT provider is looking for a small tool to sort the results of a network scan. On GitHub, they find a project that does exactly that, with clear instructions: clone, open in Visual Studio, build. They build it. That’s all it took to infect their computer.
On November 5, 2026, security firm Doctor Web described a campaign of fake GitHub security tools that has already compromised more than 2,000 Windows computers. After two years of targeting crypto and gaming fans, the attackers now publish fake tools for scan automation, security testing or log analysis. In other words, they target the people who hold the most valuable access in your business.
Fake GitHub security tools: where the trap hides
What to notice
1A “pre-build event”: Visual Studio runs this command automatically, before the program even exists. Building is enough; you don’t need to run the tool.
2The real code is pushed far to the right by hundreds of spaces. In the editor or on GitHub, all you see is “echo Building…”.
3PowerShell is launched hidden, with no restrictions, from a public folder anyone can write to.
In the Python and Go versions, the same whitespace trick hides a malicious statement at the end of a normal line. Some variants also use Visual Studio’s .suo file.
What happens after the build
1
Encrypted link
PowerShell pulls an encrypted string from Pastebin, YouTube, Telegram, Google Docs or GitCode. Once decrypted, it gives the address of the real file.
2
“Microsoft.exe”
An archive is unpacked into C:\ProgramData\Windows.Microsoft.Photos. The loader has a reassuring name.
3
Defences switched off
Smart App Control disabled, antivirus script scanning neutralized, Defender exclusions added, UAC, System Restore and shadow copies disabled.
4
Antivirus removed
It tries to uninstall ESET, McAfee and Malwarebytes, and edits the hosts file to block their updates.
5
Takeover
Two AsyncRAT backdoors, a clipper that swaps copied crypto wallet addresses, and an information stealer.
What the stealer takes
On a technician’s or developer’s computer, the stolen data isn’t just used to empty a crypto wallet. It often opens your servers and your website:
What the information stealer (JS.Stealer.191) goes after
Browsers
Saved passwords, session cookies and autofill: your Microsoft 365, banking and cloud tool access.
Critical
FileZilla (XML files)
FTP/SFTP addresses, usernames and passwords for the websites this person maintains.
Critical
MobaXterm.ini
SSH sessions to your servers, sometimes with saved passwords.
Critical
VPN configurations
What’s needed to connect to your network from outside.
Critical
Total Commander (wcx_ftp.ini)
Other saved FTP connections.
High
Discord, Telegram, games
Personal accounts, resold or used to spread the attack.
Medium
Everything is sent to the attackers through a Telegram bot. If a computer was hit, change every saved password from another clean device, not just the ones on that computer. It’s the same reflex as for the trojanized Claude Code extension in Cursor or the malicious AGENTS.md file: technical people’s tools have become a target.
The beliefs that make this trap work
Five rules for tools found on GitHub
Team rules
Before building or running a tool found online
- A separate test computer or virtual machine, never the computer that holds your passwords and access.
- No administrator rights to test an unknown tool.
- Read the project files (.csproj, .sln, scripts) as plain text before opening the project in Visual Studio.
- Prefer official releases from the tool’s known author, not an “improved version” from a stranger.
- No server passwords saved in FileZilla, MobaXterm or the browser: use a password manager with MFA.
These rules also apply to your IT provider or freelancer: ask how they test the tools they use on your systems.
How NeoTech can help
We set up separate test machines, remove unnecessary admin rights, move server passwords into a secure manager, and our automated 24/7 monitoring with on-call technician intervention responds when an antivirus is disabled or a Defender exclusion appears. Learn about our cybersecurity services.
Book your free cyber check
In 30 minutes, we look at who, in your team or at your providers, has technical access, where your server passwords are saved, and what a trojanized tool could take.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- BleepingComputer — fake security tools on GitHub push backdoors and infostealers, Nov. 6, 2026
- GBHackers — fake GitHub security tools infect over 2,000 computers, Nov. 7, 2026
- Threadlinqs — technical summary and indicators (Trojan.Loader.3261)
Photo: Alicia Christin Gerald, Pexels (Pexels licence).