Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories

What Happened

Researchers discovered a network of fake software projects on GitHub designed to trick people into downloading malware. The operation, called 'Muck and Load,' involves 222 fake repositories across 190 GitHub accounts that use automated systems to make the projects look actively maintained and trustworthy. The attack starts with a malicious Go programming package disguised as a DNS scanning tool, which secretly launches a hidden PowerShell script. That script downloads encrypted instructions from public websites like Pastebin, Telegram, and YouTube to find the real malware. The malware is delivered as a password-protected archive that, when opened, installs remote access tools and password-stealing programs on the victim's computer. Anyone who downloads and runs software from unfamiliar GitHub repositories—especially tools related to cryptocurrency wallets, game cheats, or automation bots—is at risk. Users should verify the authenticity of any open-source package before installing it, and organizations should monitor for unusual PowerShell activity and unexpected file downloads.

Key Takeaways

• A malicious Go module (github.com/kaleidora/dnsub-scanning-tool) impersonating a DNS scanner tool served as the entry point for a multi-stage Windows malware delivery chain
• Operation Muck and Load encompasses 222 confirmed GitHub lure repositories across 190 accounts using automated commit-farming workflows to simulate activity and credibility
• The loader chain uses public dead-drop resolvers (Pastebin, Rlim, Telegram, YouTube, Instagram, Google Docs, GitCode) for resilient payload-location resolution, making takedowns harder
• Final payloads include AsyncRAT, Quasar, Remcos RATs, Vidar infostealer, and XMRig/BitMiner cryptominers, with at least 14 confirmed malware files across GitHub repositories
• Threat actor pivots include email [email protected] used in GitHub Actions commit-farming workflows and Muck-themed domains muckcoding.com and muckdeveloper.com

Affected Systems

• Windows systems targeted by the multi-stage loader chain
• Go module ecosystem (Go module proxy)
• GitHub users and developers who clone or build untrusted repositories
• Developers using Go package management tools

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Malicious Go module (github.com/kaleidora/dnsub-scanning-tool) impersonates dnsub DNS scanner and is distributed via Go module proxy
2. Execution: Go module's main.go launches hidden PowerShell to download encoded content from muckcoding.com, saves as api.db, decodes with certutil to L.ps1, and executes with -ExecutionPolicy Bypass
3. Defense Evasion: L.ps1 uses multi-layer Base64/XOR encryption with Invoke-Expression across three encrypted layers to recover final resolver logic; disables TLS certificate validation
4. C2/Resolver: Final decoded script queries public dead-drop locations (Pastebin, Rlim, Telegram, YouTube, Instagram, Google Docs, GitCode) for encrypted payload-location material marked with 'LastW' string
5. Payload Delivery: Resolved URL points to password-protected Quixo.7z on GitHub; archive downloaded, extracted using dropped 7zrr.exe into masqueraded C:\ProgramData\Windows.Microsoft.Photos\ directory
6. Impact: Microsoft.exe launches from masquerade path delivering AsyncRAT, Quasar, Remcos, Vidar infostealer with capabilities including credential theft, screen capture, persistence via scheduled tasks and services, and defense evasion via Microsoft Defender/UAC modification

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The article does not provide formal detection rules (YARA, Sigma, Snort, etc.). It provides behavioral indicators, IOCs, and MITRE ATT&CK technique mappings that could be used to build custom detections. A separate GitHub infrastructure appendix with 222 confirmed repositories is published at the Socket threat research IOCs repository.

Detection Engineering Assessment

Required Log Sources

• Process creation events (Sysmon Event ID 1 / Windows Security Event ID 4688)
• PowerShell script block logging (Event ID 4104)
• File creation events (Sysmon Event ID 11)
• Network connection events (Sysmon Event ID 3)
• Certificate validation override detection
• GitHub Actions workflow logs
• Go module proxy download logs

Hunting Hypotheses

Control Gaps

• Traditional AV signatures may not detect the multi-layer encrypted PowerShell loader since each layer is only decrypted in memory
• Network-level blocking of dead-drop resolver traffic is ineffective without risking blocking legitimate access to Pastebin, YouTube, Telegram, and Google Docs
• GitHub lure repositories with synthetic commit activity may pass automated trust/reputation checks that rely on repository activity metrics
• The use of a signed Electron-style executable (signed by Exodus Movement, Inc.) may bypass application allowlisting that relies on digital signatures
• Password-protected 7z archives may evade content inspection and sandbox detonation at email or web gateways

Key Behavioral Indicators

• PowerShell process launched with -WindowStyle Hidden and -ExecutionPolicy Bypass flags
• certutil.exe invoked with -decode argument on files in C:\Users\Public\ directories
• Process executing from C:\ProgramData\Windows.Microsoft.Photos\current\Microsoft.exe (non-standard Microsoft Photos path)
• 7-Zip extractor binary (7zrr.exe) running from C:\ProgramData\zipathh\ (non-standard path)
• PowerShell script disabling certificate validation via ServerCertificateValidationCallback
• Sequential network connections to multiple public content platforms within short timeframes
• GitHub Actions workflows with every-minute scheduling and force-push of synthetic commits
• Git commit metadata showing constant email address across different repository owner usernames
• Go module with abnormally high version count (1,200+ versions) for a small utility package

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider implementing allowlisting for Go module imports in your CI/CD pipelines to prevent unauthorized or unvetted packages from being pulled into builds.
• Evaluate whether your web filtering solution can selectively block specific Pastebin, Rlim, and GitCode raw URLs rather than blocking entire domains, to reduce the dead-drop resolver attack surface.
• If your organization uses GitHub, consider monitoring for GitHub Actions workflows with every-minute scheduling and force-push patterns that rewrite log or timestamp files, as these may indicate commit-farming activity.
• Consider implementing network segmentation to restrict development systems from making outbound connections to public content-sharing platforms during build processes.

User Protection

• Consider deploying enhanced PowerShell logging (Script Block Logging, Transcription) across endpoints if not already enabled, to capture the multi-layer decryption chain.
• Evaluate whether your EDR can alert on processes executing from C:\ProgramData\ subdirectories with Microsoft-themed names, as these are non-standard application paths.
• Consider enabling certificate pinning or validation enforcement for critical applications to detect PowerShell scripts that disable certificate validation.
• If applicable, consider deploying application allowlisting that validates both signature and file path, not just signature alone, to catch signed-but-masqueraded executables.

Security Awareness

• Consider adding guidance to existing developer awareness programs about the risks of importing obscure or newly published Go modules, especially those impersonating known tools.
• Consider educating developers and users about the threat of GitHub repositories with artificially inflated activity metrics and how to evaluate repository legitimacy beyond commit frequency.
• Consider incorporating warnings about cryptocurrency-themed, game-cheat, and offensive-tooling lures into existing security awareness training, as these are common social engineering vectors.
• If your organization has developers who use open-source packages, consider promoting the use of package provenance verification tools and dependency scanning in development workflows.

MITRE ATT&CK Mapping

Additional IOCs

• Urls:
  • hxxps://muckcoding[.]com/LG-LW/Api-Certificate - First-stage download URL; Go module retrieves encoded PowerShell content disguised as certificate artifact, saved locally as api.db
  • hxxps://muckdeveloper[.]com/LGTV/MicrosoftCur - Muck-themed dead-drop resolver URL hosting encrypted payload-location material
  • hxxps://pastebin[.]com/raw/ULQUekEf - Additional Pastebin dead-drop resolver URL identified in image analysis; hosts encrypted payload-location material with LastW marker
  • hxxps://youtu[.]be/GAS67zAOssc - Fallback YouTube dead-drop resolver URL; used as recovery path if primary sources are removed
  • hxxps://www[.]instagram[.]com/p/DG20Zt9Mj4P/ - Fallback Instagram dead-drop resolver URL; used as recovery path for encrypted payload-location material
  • hxxps://t[.]me/s/dwmic - Telegram dead-drop resolver channel (DwMic); hosts encrypted payload-location material as fallback source
  • hxxps://docs[.]google[.]com/document/d/1PnogKWvfa3ZcCnmKfnb3pJYXMBmcQe5k_6bBuPUailQ/export?format=txt - Google Docs dead-drop resolver URL; exports document as text containing encrypted payload-location material
  • hxxps://gitcode[.]com/LastWer/MicrosoftCur/raw - GitCode dead-drop resolver URL; hosts encrypted payload-location material as fallback source
  • hxxps://github[.]com/nrevv1lad/Pubg-DESYNC-Menu - Malware-bearing GitHub lure repository posing as PUBG cheat; hosts Loader.exe associated with Vidar infostealer
  • hxxps://github[.]com/AkumaDarks/Exodus-Two-Factor-Authentication-Protec - GitHub lure repository impersonating Exodus 2FA tool; part of 222-repository lure network
  • hxxps://github[.]com/Ohtopusesi2/Metamask-Wallet-Connect-Sdk-Web3-Integration-Eth - GitHub lure repository impersonating MetaMask WalletConnect SDK; part of lure network targeting crypto users
  • hxxps://github[.]com/MACv1sh/RaidVortex-Stealer-Discord-FUD - GitHub lure repository advertising Discord stealer tool; part of confirmed lure network
• File Hashes:
  • 129de16fe69763f767d8249279a2c4a1a6deafadd1a84563bd84b258ea010bff (SHA256) - Layer 1 encrypted PowerShell blob; decrypted with hardcoded 32-byte XOR key
  • 86819efe7319b664920ba2e1fd4b079a4e6b5eaaebeeb1adb2c1c8dc3c81ee0c (SHA256) - Layer 1 decrypted PowerShell script; contains second encrypted PowerShell layer
  • 57e0449fb13766b0b2f7c057b1f89911e9ed23cac7e71d5d69fde47571239629 (SHA256) - Layer 2 encrypted PowerShell blob; uses Base64, XOR, and Invoke-Expression for decryption
  • e576a61e1a2ba71e764647bb2f0883c2f8fa4d591799c60d21a84230ee7a5b63 (SHA256) - Final visible decoded PowerShell loader logic; acts as resolver, downloader, extractor, and launcher
  • 51cada347262d7b2bcde70552fcdae221625ad75435cee8a9c3e7b67cc47a807 (SHA256) - Encrypted payload-location blob recovered from dead-drop material; decrypted to resolve GitHub release URL
  • a628ad47fe93ee7413cca90aeca8f9540bfcd5ccdbeb4d9914670b3ef66247f4 (SHA256) - Related GitHub-hosted Quixo.7z sample; maps to Remcos-style RAT activity
  • 235a64e3520b1c2c27763122b303f78aee8d7c083dfd9f1eb936cd5174383609 (SHA256) - Confirmed malware sample from threat actor-controlled GitHub repository
  • 2f416aac027f19f563cc45e3b4b72e992aaafb63da27f968b9a76a391134dc7d (SHA256) - Confirmed malware sample from threat actor-controlled GitHub repository
  • 33497c69c21fa96bbc96f1d7f09608e462f8ab22555364977c0bd35fef27bc29 (SHA256) - Confirmed malware sample from threat actor-controlled GitHub repository
  • 45126b353f1636103da356121cd00b229b635b41b99d91166e6d7d9037482242 (SHA256) - Confirmed malware sample from threat actor-controlled GitHub repository
  • 810614290bdb14d2ddf10f65f8adc988a8272764f2a9e2c378e52fad162da344 (SHA256) - Confirmed malware sample from threat actor-controlled GitHub repository
  • 938054c6bb7dc737fce16513b2882808f199c2f892f808d439525a1650d49089 (SHA256) - Confirmed malware sample from threat actor-controlled GitHub repository
  • 9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7 (SHA256) - Confirmed malware sample from threat actor-controlled GitHub repository
  • a2e7989742c6b6436ebb47507881946e4f662080dff71d104eb9a9554f38af7a (SHA256) - Confirmed malware sample from threat actor-controlled GitHub repository
  • b27f694c974b44fe2f4a8a25680997db574fa35686c30fa4c4dc9dd4ec40005e (SHA256) - Confirmed malware sample from threat actor-controlled GitHub repository
  • d7747e7a3c782009f4ceb6e9c106115876386853929563b509da5258e3968d15 (SHA256) - Confirmed malware sample from threat actor-controlled GitHub repository
  • d95bba20f04687b0b821d4fc0a17137db8b9eda5fe3fb34da319abefc45fe0d1 (SHA256) - Confirmed malware sample from threat actor-controlled GitHub repository
  • e73491065d86b1ad69229bb5d2019e08b947e11a2a57adf5c2d9a2b5d8f4acad (SHA256) - Confirmed malware sample from threat actor-controlled GitHub repository
  • ec1cac2ada6726623b4bafb94c204c359ce7cdf5325909137fc0e6aef506783f (SHA256) - Confirmed malware sample from threat actor-controlled GitHub repository
  • f245956c930f220f0bedf355a751a5cd738b4ec6bb6c5d584199ab3fa6c0a1c4 (SHA256) - Confirmed malware sample from threat actor-controlled GitHub repository
• File Paths:
  • C:\Users\Public\Pictures\api.db - Attacker-dropped encoded payload file disguised as database; downloaded from muckcoding.com and decoded with certutil
  • C:\Users\Public\Pictures\L.ps1 - Attacker-dropped decoded PowerShell loader script; multi-layer encrypted loader with dead-drop resolver logic
  • C:\Users\Public\Documents\umun\ - Attacker-created staging directory for Quixo.7z archive download
  • C:\ProgramData\zipathh\7zrr.exe - Attacker-dropped 7-Zip command-line extractor used to extract password-protected Quixo.7z archive
  • C:\ProgramData\Windows.Microsoft.Photos\current\Microsoft.exe - Masqueraded execution path for final payload; mimics legitimate Microsoft Photos application directory
• Command Lines:
  • Purpose: Hidden PowerShell execution to download and decode first-stage payload from remote server | Tools: powershell.exe, Invoke-WebRequest, certutil | Stage: Initial Access / Execution | powershell.exe -WindowStyle Hidden -Command Invoke-WebRequest
  • Purpose: Decode downloaded encoded content using certutil living-off-the-land technique | Tools: certutil | Stage: Defense Evasion / Deobfuscation | certutil -decode
  • Purpose: Execute decoded PowerShell script with execution policy bypass | Tools: powershell.exe | Stage: Execution | powershell.exe -ExecutionPolicy Bypass
  • Purpose: GitHub Actions commit-farming workflow to generate synthetic repository activity | Tools: git, github-push-action | Stage: Infrastructure / Lure Maintenance | git config --local user.email
• Other:
  • LastW - Resolver marker string used to locate encrypted payload-location material in dead-drop content
  • UIA14fogylw8ogL82FntOFGp6 - Hardcoded 32-byte XOR decryption key used to decrypt payload-location blob from dead-drop material
  • r8NnX1b8Xn - Hardcoded password for extracting Quixo.7z payload archive
  • 73hvdu342 - Secondary password/string observed in staged activity
  • Direkt calistir, baska adim gerekmez - Turkish-language comment in loader meaning 'Run directly, no other step is needed'
  • CaptureScreens.ps1 - Screenshot-collection script name used in post-execution payload activity
  • Nvdia - Suspicious misspelling/masquerade string used to impersonate NVIDIA-related components