Malicious GitHub security projects target cybersecurity professionals

A malware campaign has shifted from cryptocurrency users to cybersecurity professionals through infected GitHub projects advertised for scanning, security testing and log analysis, BleepingComputer reports. Dr. Web researchers found more than 2,000 compromised Windows systems in the campaign. Malicious code hidden in project files and scripts retrieves an Electron-based loader that establishes persistence and interferes with Windows security features. Its payloads include AsyncRAT, malware that replaces cryptocurrency wallet addresses, and an information stealer that collects browser data, VPN settings and Discord tokens for exfiltration through a Telegram bot.