GitHub: fake Fscan helper, 2,000 Windows hosts

Cybersecurity staff are the new target of a GitHub campaign that offers security tools and delivers a backdoor. Dr. Web, which published the research, says the operator has been at it for about two years. The early lures were crypto-wallet bait, blockchain games, bots, and game cheats. The recent repositories advertise scan automation, security testing, and log cleanup. One of them is pitched as a small script that parses and formats output from Fscan, a network scanner practitioners already recognize. The familiar tool is the hook. The repository is the payload.

Dr. Web counts more than 2,000 compromised Windows systems. The code it found sat inside Visual Studio projects, Python scripts, and Go sources, padded so a quick scroll looks empty. In some Visual Studio projects a build step runs that code before compilation finishes. A workstation that only compiled a helper has already executed it. This briefing names the outcome. It does not describe the loader chain.

What lands on the machine

The end state Dr. Web describes is three payloads. AsyncRAT gives the operator a remote backdoor. A clipper watches the clipboard and swaps cryptocurrency addresses. An information stealer takes browser data, VPN settings, FTP client configuration, gaming-account data, and Discord tokens, and sends them out through a Telegram bot. The same infection tries to remove ESET, McAfee, and Malwarebytes, cut those products off from their update servers, and interfere with Windows backups. Dr. Web also found an unfinished component meant to put the loader back if someone deletes it. The operator is still adding pieces. A cleanup that only deletes one file will miss the next one.

The loader itself is an Electron program the researchers saw under the name Microsoft.exe. It persists, raises its rights, and turns down Windows security and recovery on the host. Searching a fleet for that filename is a lead. It is not proof by itself, and it is not a script to paste into a ticket.

What to do with the clone

Stop building security tools from GitHub accounts you cannot tie to a vendor or a colleague. A README that says “lightweight Fscan parser” is not a review. Read project files and build events before a scanner workstation compiles them, and prefer a signed release from the project that actually ships the scanner.

Any Windows host that cloned or built one of these repositories should be treated as compromised. Take it off the network, keep it for forensics, and rebuild it. Rotate passwords, VPN profiles, FTP credentials, browser-saved secrets, and Discord tokens that lived on that machine. Anyone who copied a wallet address on that keyboard should confirm the destination with the recipient through another channel. The clipper’s job is to change the address after a person has already checked it once.

Point detection at the indicators Dr. Web published, and at the symptoms around them: security products that vanished, backup jobs that stopped, and an unexpected Electron binary posing as a Microsoft executable. Re-scan developer laptops that pull unfamiliar repositories into a lab. The campaign moved from wallet users to the people who run scanners. The next lure will look like another tool those people meant to install.

This briefing relies on public reporting by BleepingComputer and on Dr. Web’s research note. It does not include exploit procedures, payloads, or reproduction detail.