---
title: Hunt: fake GitHub 'security tools' (Fscan helpers, scanners, log parsers) drop AsyncRAT, a clipper and a stealer via Electron Microsoft.exe | ctxsec
url: https://ctxsec.com/items/hunt-drweb-fake-github-security-tools-asyncrat-clipper-stealer
description: "Doctor Web says threat actors who previously poisoned blockchain-game and cheat repos on GitHub have pivoted to lures aimed at information-security developers \u2014 repos that claim to automate scans, security testing or log cleanup (including a fake Fscan output cleaner). Malicious code hides in Visual Studio .csproj PreBuildEvent / .suo files and behind long whitespace runs in Python and Go sources. A PowerShell stage fetches Quixo.7z \u2192 Electron loader Microsoft.exe (Trojan.Loader.3261), which disables defenses and injects AsyncRAT, a clipboard clipper and JS.Stealer.191. Doctor Web counted more than 2,000 infected Windows PCs at the time of the write-up."
status: "confirmed research (Doctor Web, Nov 5; BleepingComputer summary Nov 6); >2,000 Windows hosts reported compromised"
published: 2026-11-06
---

> Doctor Web says threat actors who previously poisoned blockchain-game and cheat repos on GitHub have pivoted to lures aimed at information-security developers — repos that claim to automate scans, security testing or log cleanup (including a fake Fscan output cleaner). Malicious code hides in Visual Studio .csproj PreBuildEvent / .suo files and behind long whitespace runs in Python and Go sources. A PowerShell stage fetches Quixo.7z → Electron loader Microsoft.exe (Trojan.Loader.3261), which disables defenses and injects AsyncRAT, a clipboard clipper and JS.Stealer.191. Doctor Web counted more than 2,000 infected Windows PCs at the time of the write-up.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-drweb-fake-github-security-tools-asyncrat-clipper-stealer.md)

confirmed research (Doctor Web, Nov 5; BleepingComputer summary Nov 6); >2,000 Windows hosts reported compromised

2026-11-06

### Hunt: fake GitHub 'security tools' (Fscan helpers, scanners, log parsers) drop AsyncRAT, a clipper and a stealer via Electron Microsoft.exe

- **Look for:** unexpected PreBuildEvent PowerShell in cloned 'security' repos; `C:\Users\Public\Pictures\t.ps1` / `L.ps1`; unpack under `C:\ProgramData\Windows.Microsoft.Photos`; process names Microsoft.exe / injections into RegAsm.exe, dwwin.exe, dwm.exe.
- **Infra IOCs (Doctor Web):** muckanthropic[.]com, muckduck.duckdns[.]org, muckcoding[.]com, muckdeveloper[.]com, 130.12.182[.]172.
- **Loader Mode3 tells:** PPID spoof to explorer.exe, Smart App Control registry flip, ntdll unhook, direct syscalls, EtwEventWrite/AmsiScanBuffer patches; Mode2 falls back to Defender exclusions + RegAsm inject.
- **Defense:** treat unaudited GitHub security helpers as hostile until reviewed; prefer signed vendor tools; scan downloads before opening in Visual Studio.

Sources: [Doctor Web: Threat actors target information security developers on GitHub (Nov 5)](https://news.drweb.com/show/?i=15311&lng=en) · [BleepingComputer: Fake security tools on GitHub push backdoors and infostealers (Nov 6)](https://www.bleepingcomputer.com/news/security/fake-security-tools-on-github-push-backdoors-and-infostealers/)