15 minhigh
Malicious GitHub Campaign: Fake “Arctic Wolf” and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer
An unattributed, financially motivated threat actor has operated at least 292 brand-impersonation GitHub repositories since 26 June 2026 to distribute a BoryptGrab-lineage Windows infostealer. The delivery chain abuses GitHub trust by routing users through *.github.io redirectors to actor-controlled download pages that serve ZIP archives containing a legitimate signed WinGUP updater (gup.exe) that side-loads a trojanized libcurl.dll, which reflectively executes an 11-module in-memory stealer. The stealer bypasses Chrome App-Bound Encryption v20 via in-process reflective DLL injection into the browser process, scans Steam process memory for live session tokens, harvests credentials from 19+ browsers and 41 cryptocurrency wallet paths, and exfiltrates all data via raw-socket chunked POST to a hardcoded C2 at 193.143.1.131 in Russia.
Sens:■ Immediate
Showing defanged values
- domainbentleyvazquezpvey[.]github[.]ioGitHub Pages redirector subdomain used for the Arctic Wolf lure, redirecting victims from the fake GitHub repository to the actor-controlled distribution domain. Reported and taken down by GitHub after abuse flagging.
- domaintargetroyena[.]comActor-controlled distribution domain serving the templated fake download page and the /download-archive endpoint that generates branded malicious ZIP archives. Observed serving the Arctic Wolf lure.
- ip193[.]143[.]1[.]131Hardcoded C2 server receiving exfiltrated data via raw Winsock chunked POST /upload with X-Filename and X-Size headers. Hosted on Proton66 OOO (AS198953, Russia), a bulletproof hosting provider associated with malware operations.
- sha25607dcc12197490bf3292619273ba8b11a960273a34265bca3b7d6d40e8c47dc82dll.dmp — decrypted implant recovered from process memory during analysis.
- sha2561c854a6aa415f4be964e8a4be49c06e092156bf66d71f9c79995b3e6b156e778SHA-256 of the delivered malicious ZIP archive (Arctic-Wolf-6.86.5.zip, ~136 MB) containing renamed WinGUP gup.exe, trojanized libcurl.dll, and filler DLLs used as size padding.
- sha25652825dbf3fc28b9f7c3a24adf78d3425ac714e975769f4d70e8c718ddcbb9856Reference BoryptGrab binary from Trend Micro's prior reporting, used for BinDiff comparative analysis. Not from this campaign but confirms shared codebase (1,638 matched functions).
- sha2566db05c4473760c44fa572ffac4c5911b35caf2467a37726c21c5f87e25cb2ea8SHA-256 of trojanized libcurl.dll loader (Sample A), compiled 2026-06-29 10:55:33 UTC. PE64 DLL, ~9.96 MB. Decodes wordlist-encoded blob and reflectively executes embedded infostealer via COM/SafeArray. Part of a rotating set regenerated ~every 60 seconds.
- sha2568e1ea6d9a8ccb303be9a2aad3524a529d0d99b1b24a136d8422276e942c4c4b8SHA-256 of the final in-memory infostealer PE (nested payload recovered from .rdata offset 0x1400930f0). x86-64 PE compiled with VS2022 17.5.4 and VS2010 v10.0 SP1, ~900 KB, no .rsrc section.
- sha256e9a56961980031a45e578472836576da874512bff50ca3d491fc72e52f7cc7c2GrabPure_Dump.bin — cleaner process-memory extraction of the stealer used for static analysis (159,853 lines decompiled).
- sha256fd01262bd56510088b9ddfe58ca101abb98575f3c0259b480a31b917aa73bc56SHA-256 of trojanized libcurl.dll loader (Sample B), second recovered sample consistent with the server's ~60-second payload regeneration cycle. Same functionality as Sample A.
- urlhxxps://bentleyvazquezpvey[.]github[.]io/[.]github/Arctic-WolfFull redirector URL path from the fake Arctic Wolf GitHub repository README to the distribution domain.
- urlhxxps://targetroyena[.]com/nwuoqtzmwv9q/Arctic-Wolf[.]github[.]ioSpecific fake download page URL observed for the Arctic Wolf lure, serving the templated gh-downloader page with spoofed trust badges.
Detection / Hunteropenrouter
What Happened
Since late June 2026, a cybercriminal has created hundreds of fake GitHub pages that impersonate well-known software and security companies, including Arctic Wolf, to trick people into downloading malware disguised as legitimate software. When someone searches for a program online and visits one of these fake pages, they are redirected to a convincing download page that gives them a ZIP file. Inside the ZIP is a real, signed program that secretly loads a malicious component, which then runs an information-stealing program entirely in the computer's memory — meaning traditional antivirus software may not detect it. The malware steals saved passwords from over 19 web browsers, cryptocurrency wallet files, login sessions for Telegram, Discord, and Steam, files from the user's Desktop and Documents folders, and takes a screenshot of the screen. All stolen data is sent to a server in Russia. Anyone who downloads software from unverified GitHub pages could be affected. Organizations should block the known malicious server address, educate employees to only download software from official vendor sources, and hunt for the specific behaviors described in this report on their endpoints.
Key Takeaways
- Unattributed, financially motivated Russian-speaking operator published 292+ brand-impersonation GitHub repositories since 26 June 2026, including a fake Arctic Wolf page, to distribute a BoryptGrab-lineage Windows infostealer.
- Delivery chain uses GitHub README links → *.github.io redirectors → actor-controlled distribution domains → templated fake download page → ZIP archive containing a renamed legitimate WinGUP gup.exe that side-loads a trojanized libcurl.dll, which reflectively executes the stealer entirely in memory via COM/SafeArray staging.
- The in-memory infostealer runs 11 sequential theft modules: browser credential/cookie theft (19+ browsers with Chrome App-Bound Encryption v20 bypass via in-process reflective DLL injection), Telegram session theft, Discord token extraction, Meta Max credential harvesting, Steam process-memory scanning, 41-entry cryptocurrency wallet path table, file grabbing from Desktop/Documents, screen capture, and Windows Credential Manager dumping.
- No CVE or software vulnerability is exploited; the attack relies entirely on social engineering and trust abuse. The payload establishes no persistence and performs no anti-analysis, but leaves a recoverable staging folder on disk (decrypt_browser, \Filegraber, logs) because it lacks the cleanup routine present in the reference BoryptGrab build.
- Hardcoded C2 at 193.143.1.131 (Proton66, AS198953, Russia) receives exfiltrated data via raw Winsock chunked POST with custom X-Filename and X-Size headers. The download server regenerates payload hashes approximately every 60 seconds, producing unique per-download samples.
Affected Systems
- Windows desktop users (x86-64) who download software from GitHub repositories
- Users of Chromium-family browsers (Chrome, Edge, Brave, Vivaldi, Opera, Yandex, and 13+ others) with stored credentials and cookies
- Cryptocurrency wallet holders using 32+ desktop wallet brands (Bitcoin Core, Exodus, Electrum, Ledger Live, Atomic, etc.)
- Telegram Desktop, Discord, Meta Max messenger, and Steam users on Windows
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Victim searches for software online and lands on one of 292+ brand-impersonation GitHub repositories with a README containing a concealed download link
- Redirection: Concealed link routes through a *.github.io redirector (e.g., bentleyvazquezpvey.github.io) to an actor-controlled distribution domain (e.g., targetroyena.com) serving a templated fake download page with spoofed trust badges
- Execution: Victim downloads a ZIP archive (~136 MB) containing a renamed legitimate signed WinGUP gup.exe and a trojanized libcurl.dll plus filler files for size padding; running gup.exe side-loads libcurl.dll from the working directory
- Defense Evasion: libcurl.dll decodes a wordlist-encoded embedded blob, transforms it into a PE, validates the MZ/PE header, and reflectively executes the infostealer in memory via COM/OLE SafeArray staging — no payload written to disk
- Collection: 11 theft modules execute sequentially — system fingerprinting, installed app enumeration, browser credential/cookie theft (19+ browsers with Chrome ABE v20 bypass via in-process injection), Telegram session theft, Discord token extraction, Meta Max credential harvesting, Steam process-memory scanning, 41-path crypto wallet theft, file grabbing, screenshot capture, and Windows Credential Manager dump
- Exfiltration: All stolen data is packaged into a ZIP archive and exfiltrated via raw Winsock chunked POST /upload with custom X-Filename and X-Size headers to hardcoded C2 at 193.143.1.131 (Proton66, AS198953, Russia); staging folder is left on disk
Detection Availability
- YARA Rules: Yes
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Arctic Wolf official public GitHub repository
YARA rules for detecting the C2 exfiltration pattern (raw Winsock POST /upload with X-Filename and X-Size headers and chunked transfer encoding) and additional IOCs are available in Arctic Wolf's official public GitHub repository. The article also provides detailed behavioral detection guidance for DLL side-loading, Chrome ABE bypass injection, Steam process-memory access, and browser process termination patterns.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | The malware performs multiple EDR-visible behaviors: DLL side-loading (gup.exe loading unsigned libcurl.dll from user-writable paths), process injection (CreateProcessW + VirtualAllocEx + CreateRemoteThread into browser processes), process memory access (ReadProcessMemory against steamwebhelper.exe), browser process termination by a non-browser parent, and CredEnumerate API calls. EDR products with process ancestry, module loading, and API call telemetry should detect multiple stages. |
| Network Visibility | Medium | The C2 uses a single hardcoded IP (193.143.1.131) with raw Winsock HTTP POST /upload and custom headers (X-Filename, X-Size, Transfer-Encoding: chunked). Egress monitoring to non-CDN IPs with these headers is detectable, but the traffic is HTTP and could blend with other web traffic if not specifically profiled. The distribution domains and github.io redirectors are also observable in web proxy logs. |
| Detection Difficulty | Moderate | The DLL side-loading pattern (signed gup.exe loading unsigned libcurl.dll from user-writable paths) is well-documented and detectable by EDR. The in-memory execution via COM/SafeArray evades disk-based signatures but the injection into browser processes is visible. The lack of anti-analysis or persistence simplifies triage. However, the ~60-second payload regeneration produces rotating hashes, reducing the effectiveness of static hash-based detections. The main challenge is the social engineering delivery vector via legitimate GitHub infrastructure, which is difficult to block at the network level without false positives. |
Required Log Sources
- Sysmon Event ID 7 (Image Loaded) — for DLL side-loading detection
- Sysmon Event ID 8 (CreateRemoteThread) — for browser process injection
- Sysmon Event ID 10 (ProcessAccess) — for Steam process-memory reads
- Sysmon Event ID 1 (Process Creation) — for non-browser parent spawning browser processes
- Sysmon Event ID 5 (Process Terminate) — for browser process kills by unsigned parent
- EDR process telemetry with module signature validation
- Network firewall/proxy logs for egress to 193.143.1.131 and distribution domains
- DNS resolution logs for *.github.io redirector subdomains
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Hunt for instances of gup.exe (or renamed copies matching the WinGUP binary) loading libcurl.dll from user-writable paths such as Downloads, Desktop, or ZIP-extraction directories rather than from an installed WinGUP location. | Sysmon Event ID 7 (Image Loaded) with ImageLoaded path analysis; EDR module load events with path and signature status | Defense Evasion / Execution | Low — legitimate WinGUP updaters load libcurl.dll from their install directories; loading from Downloads/Desktop is highly suspicious. |
| Hunt for non-browser parent processes spawning browser executables (chrome.exe, msedge.exe, brave.exe) via CreateProcessW, immediately followed by VirtualAllocEx and CreateRemoteThread into the spawned browser process — indicating the Chrome App-Bound Encryption bypass injection pattern. | Sysmon Event ID 1 (Process Create) + Event ID 8 (CreateRemoteThread) correlated by PID; EDR process injection detection events | Credential Access | Low to Medium — legitimate software updaters may spawn browsers, but the combination of spawn + remote thread creation + memory write is distinctive of injection. |
| Hunt for unsigned or non-Steam processes opening steamwebhelper.exe or steamservice.exe for process memory reads (ReadProcessMemory), particularly after a conditional Steam launch followed by a ~20-second wait. | Sysmon Event ID 10 (ProcessAccess) with TargetImage matching steamwebhelper.exe/steamservice.exe; EDR process access events with caller signature validation | Credential Access | Low — Steam itself and legitimate game overlays access these processes, but unsigned/non-Steam callers are highly suspicious. |
| Hunt for HTTP POST requests to non-CDN destination IPs carrying custom X-Filename and X-Size headers with Transfer-Encoding: chunked, particularly targeting the /upload endpoint — the stealer's raw Winsock exfiltration signature. | Network IDS/IPS signatures, proxy logs with header inspection, Zeek HTTP logs | Exfiltration | Low — the combination of custom headers (X-Filename, X-Size) with chunked encoding to a raw IP is uncommon in legitimate traffic. |
| Hunt for the presence of staging directories named decrypt_browser\ and \Filegraber\ (note the misspelling) in %TEMP% or other temporary locations, along with browser_decryption.log, installed_applications.txt, UserInformation.txt, and sends.log — the stealer's uncleaned forensic footprint. | EDR file creation events, Sysmon Event ID 11 (FileCreate) in temp directories, filesystem scans during incident response triage | Collection / Post-Infection Triage | Very Low — the specific misspelling of Filegraber and the combination of these specific filenames is a high-confidence post-infection indicator. |
Control Gaps
- Traditional AV signatures relying on file hashes will be evaded by the ~60-second payload regeneration cycle producing unique per-download samples.
- Disk-based malware scanning will miss the in-memory infostealer execution via COM/SafeArray staging, as no payload PE is written to disk.
- Network controls blocking known malicious domains may not catch the ~78 active *.github.io redirectors or the ~20 rotating distribution domains, as these are on legitimate infrastructure.
- Application allowlisting may not flag gup.exe as malicious since it is a legitimate signed binary, allowing the DLL side-loading to proceed.
- Browser process protection features may not detect the Chrome ABE bypass because the injection originates from within the browser's own process space via a COM call, bypassing the App-Bound elevation check.
Key Behavioral Indicators
- gup.exe (or renamed WinGUP binary) loading unsigned libcurl.dll from user-writable paths (Downloads, Desktop, ZIP-extraction directories)
- Non-browser parent process spawning chrome.exe/msedge.exe/brave.exe followed by VirtualAllocEx + CreateRemoteThread into the browser process
- Unsigned process performing ReadProcessMemory against steamwebhelper.exe or steamservice.exe
- Browser process termination (chrome.exe, firefox.exe, vivaldi.exe, opera.exe, brave.exe, msedge.exe) by an unsigned parent process
- HTTP POST /upload with X-Filename and X-Size headers and Transfer-Encoding: chunked to a non-CDN IP address
- Presence of \Filegraber\ directory (misspelled) and decrypt_browser\ staging folder with browser_decryption.log in %TEMP%
- CredEnumerate API calls scanning for credential entries containing @ONEME or @oneme strings (Meta Max credential harvesting)
- Process accessing HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid and HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\BackupProductKeyDefault in sequence with IP geolocation API calls
- Document title matching the template 'Github Download · * · Github' on web proxy logs — pivot for enumerating distribution infrastructure
False Positive Assessment
Low — the combination of DLL side-loading via gup.exe, in-process browser injection for Chrome ABE bypass, Steam process-memory scanning, and the specific exfiltration pattern (raw Winsock POST /upload with X-Filename/X-Size headers) is highly distinctive. The \Filegraber\ misspelling and uncleaned staging directory provide very low false-positive post-infection indicators. The main detection challenge is the social engineering delivery vector via legitimate GitHub infrastructure, which may generate false positives if blocking all .github.io subdomains.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking outbound traffic to 193.143.1.131 and monitoring the broader 193.143.1.0/24 range (Proton66, AS198953) at your perimeter firewall or proxy.
- Consider blocking the distribution domain targetroyena.com and any observed *.github.io redirector subdomains at your DNS resolver or web proxy, if supported by your tooling.
- If your EDR supports custom detection rules, consider deploying alerts for gup.exe loading unsigned libcurl.dll from user-writable paths, and for non-browser processes performing memory injection into browser processes.
- For any host suspected of executing this malware, consider rotating all browser-stored passwords, cookies, cryptocurrency wallet keys, Discord tokens, Telegram sessions, Steam credentials, and Windows Credential Manager entries, as all are likely compromised.
Infrastructure Hardening
- Evaluate whether your web proxy can alert on HTTP POST requests carrying custom X-Filename and X-Size headers with Transfer-Encoding: chunked to non-CDN destination IPs, as this is the stealer's exfiltration signature.
- Consider proactively enumerating distribution infrastructure via search-engine title queries for 'Github Download · * · Github' to pre-block hosts before users reach them.
- If applicable to your environment, consider implementing DNS filtering or sinkholing for known distribution domains associated with this campaign.
User Protection
- Consider enforcing software-source verification policies requiring employees to download tools only from vendor-verified official sources, not from GitHub .github profile repositories.
- Evaluate whether your endpoint protection can detect and block the DLL side-loading pattern where a signed executable loads an unsigned DLL from a user-writable directory.
- If your EDR supports host isolation, consider isolating any endpoint exhibiting the browser injection or Steam process-memory access patterns described in this report pending investigation.
Security Awareness
- Consider incorporating training on fake GitHub repositories and 'secure download' pages with spoofed trust badges (e.g., 'VirusTotal Approved', 'Secure Archive') into existing awareness programs.
- Reinforce that legitimate software installers do not require running executables extracted from ZIP archives, even those named after trusted software vendors.
- Consider advising users to treat GitHub .github profile repositories with sparse commit history, recent creation dates, and marketing-style READMEs as suspicious by default.
- If your organization uses Arctic Wolf or other security vendors, consider notifying employees that official GitHub pages use verified organization accounts and that impersonator pages with generic usernames should be reported.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping14 techniques
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Credential Access
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- Urls:
hxxps://targetroyena[.]com/nwuoqtzmwv9q/Arctic-Wolf.github.io- Specific fake download page URL observed for the Arctic Wolf lure, serving the templated gh-downloader page with spoofed trust badges.hxxps://bentleyvazquezpvey[.]github[.]io/.github/Arctic-Wolf- Full redirector URL path from the fake Arctic Wolf GitHub repository README to the distribution domain.
- File Hashes:
e9a56961980031a45e578472836576da874512bff50ca3d491fc72e52f7cc7c2(SHA256) - GrabPure_Dump.bin — cleaner process-memory extraction of the stealer used for static analysis (159,853 lines decompiled).07dcc12197490bf3292619273ba8b11a960273a34265bca3b7d6d40e8c47dc82(SHA256) - dll.dmp — decrypted implant recovered from process memory during analysis.52825dbf3fc28b9f7c3a24adf78d3425ac714e975769f4d70e8c718ddcbb9856(SHA256) - Reference BoryptGrab binary from Trend Micro's prior reporting, used for BinDiff comparative analysis. Not from this campaign but confirms shared codebase (1,638 matched functions).
- File Paths:
decrypt_browser\- Staging subdirectory created by the stealer for browser data extraction output. Left on disk after execution — high-confidence post-infection indicator.\Filegraber\- File grabber staging directory (note attacker's misspelling of 'Filegrabber'). Contains files matching 16 extensions and keyword filters from Desktop/Documents. Left on disk — forensic artifact.browser_decryption.log- Operational log file written by the Chrome App-Bound Encryption bypass module. Left on disk after execution.installed_applications.txt- Output of installed application enumeration module. Contains full software inventory of the victim host. Left on disk.UserInformation.txt- System fingerprint output containing 21 host fields including HWID, IP, country, OS, wallpaper SHA-1 hash, and more. Left on disk.sends.log- Exfiltration status log recording raw Winsock POST transmission results to the C2. Left on disk.libcurl.dll- Trojanized libcurl.dll dropped inside the malicious ZIP archive. Acts as the loader: decodes wordlist-encoded blob, validates PE header, and reflectively executes the infostealer in memory via COM/SafeArray.
- Other:
[email protected]- Commit-author email observed on the attacker's GitHub repositories. Low-weight attribution artifact consistent with a Russian-speaking operator.
