A new cybersecurity threat has emerged involving fake GitHub repositories that distribute a malware stealer named BoryptGrab, according to recent research by security analysts. The campaign exploits the trust users place in GitHub and free software downloads by masquerading as popular programs such as game cheats, productivity tools, media software, and utility applications.
The operation is widespread and actively maintained. Researchers have identified over 100 public GitHub repositories linked to the campaign, some dating back to 2025. These repositories are designed to appear legitimate, with search-engine-friendly titles and keywords that help them rank highly in search results. Some repositories also contain Russian-language comments and coding patterns, suggesting the involvement of a Russian-speaking threat actor.
The malware distribution begins when a user downloads a ZIP archive from one of these fake repositories. The archive may contain executables that leverage DLL sideloading to run a hidden payload. In other cases, the ZIP file includes a VBS downloader that executes obfuscated PowerShell commands to fetch malware from a remote server. Certain variants even attempt to modify Microsoft Defender settings to reduce detection.
Once the initial payload is executed, the malware chain expands into multiple components. A primary launcher installs BoryptGrab, which is capable of harvesting sensitive browser data, stored credentials, and cryptocurrency wallets. Other components may download additional malware such as a Vidar stealer variant, a Golang-based downloader named HeaconLoad, or a backdoor built with PyInstaller called TunnesshClient. These multi-stage operations increase the effectiveness and persistence of the attack.
Security experts warn that users searching for free tools or software outside official sources are particularly at risk. Fake repositories can look highly convincing, and even tech-savvy individuals may be tricked into downloading malware if they rely on search results without verifying repository credibility.
The campaign highlights ongoing risks associated with open-source platforms. GitHub and similar platforms host millions of projects, many of which are genuine and safe, but cybercriminals continue to exploit these services to spread malware. Users are advised to check repository history, verify developer credentials, and avoid downloading software from unverified sources.
Cybersecurity researchers recommend implementing strong endpoint protection, keeping software updated, and using browser and wallet security tools to mitigate the risks associated with malware like BoryptGrab. Multi-factor authentication, regular backups, and cautious handling of downloaded files can also reduce exposure to such attacks.
This incident underscores the need for vigilance in the software development ecosystem. Platforms like GitHub are essential for collaboration and innovation, but they can also be leveraged by threat actors seeking to exploit unsuspecting users. Awareness and proper security practices are key to minimizing risks posed by these increasingly sophisticated malware campaigns.
