Dr.Web research published November 5, 2026; BleepingComputer coverage November 6, 2026
The Scanner Helper Was the Malware: Fake GitHub Security Tools Put AsyncRAT on More Than 2,000 Windows Systems
The lure was aimed at the people least likely to expect it. Dr.Web reported on November 5 that a campaign running for about two years, which first targeted cryptocurrency and gaming users with blockchain games, bots and cheat tools, has shifted to cybersecurity professionals, publishing GitHub repositories that pose as helpers for scan automation, security testing and log analysis; one example is a fake script advertised as a lightweight formatter for output from the Fscan network scanner. Dr.Web counts more than 2,000 compromised Windows systems. The hiding place is the build itself: malicious code sits in Visual Studio project files, Python scripts and Go source files behind long runs of whitespace, and in Visual Studio projects a pre-build event runs it before compilation, so the infection starts when a developer builds the tool, not when they run it. A PowerShell stage retrieves an encrypted download link and fetches an Electron-based loader named Microsoft.exe, which establishes persistence, elevates privileges, and disables Windows security and recovery features; its default mode spoofs its parent process, disables Smart App Control, unhooks security tooling, and patches the AMSI and event tracing functions security products rely on. The final payloads are threefold: the AsyncRAT backdoor, in two instances on different ports, a clipper injected into a legitimate Windows process that swaps cryptocurrency wallet addresses in the clipboard, and an information stealer that collects browser data, VPN settings, FTP client configurations, gaming account data and Discord tokens and sends them out through a Telegram bot. The malware also attempts to remove ESET, McAfee and Malwarebytes products and interfere with their updates and with Windows backups. Dr.Web published a full indicator list, and the unfinished persistence component it found suggests the operator is still developing the campaign.
Executives
Your most security-aware staff are the named target of this campaign, which is precisely why it worked more than 2,000 times: the repositories offered tools of the trade, and the malicious step ran during the build, before any judgment about running an unknown program came into play. Ask whether your developer workstations, the machines with the broadest credentials in the building, are built and rebuilt in environments where an infected helper would be contained, and whether cloned third-party tooling is reviewed as code or trusted as content.
CIO / CISO
Put repository intake under the same discipline as software intake. New tooling from public repositories gets a build-file review, project files, scripts and build events included, and runs first in an isolated environment with no production credentials, because this campaign steals exactly what a security workstation holds: VPN configurations, FTP credentials, browser stores and tokens, exfiltrated through a consumer messaging channel. Add the Dr.Web indicators to detection, alert on the loader behaviors that survive renaming, AMSI and event tracing patching, Defender and recovery tampering, and security product removal attempts, and treat a developer machine hit as a credential incident, not a malware cleanup.
Engineers
Read the project file before you build anything you cloned. In a .csproj, look for PreBuildEvent routines and any PowerShell invocation; in Python and Go files, scroll past long whitespace runs or view the file with whitespace visible, since the payload hides off-screen there. Build unfamiliar tooling in a disposable virtual machine, watch for an Electron loader named Microsoft.exe appearing outside any Microsoft path, for scheduled task and registry persistence being written during a build, and for outbound Telegram traffic. If a machine built one of these repositories, rotate the credentials it held rather than only removing the malware.
Everyone (non-IT)
The home version of this lesson travels well beyond developers. Software that promises to help, a scanner, a cheat, a converter, a cleanup tool, can carry the harm inside the download itself, and the disguise works best when the tool matches what you were already looking for. Prefer tools from the original publisher site over reposted copies, be suspicious of a familiar tool in an unfamiliar repository, and keep your security software updates on, since this malware tries to switch its protection off first.