An unattributed, financially motivated threat actor has operated at least 292 brand-impersonation GitHub repositories since 26 June 2026 to distribute a BoryptGrab-lineage Windows infostealer. The delivery chain abuses GitHub trust by routing users through *.github.io redirectors to actor-controlled download pages that serve ZIP archives containing a legitimate signed WinGUP updater (gup.exe) that side-loads a trojanized libcurl.dll, which reflectively executes an 11-module in-memory stealer. The stealer bypasses Chrome App-Bound Encryption v20 via in-process reflective DLL injection into the browser process, scans Steam process memory for live session tokens, harvests credentials from 19+ browsers and 41 cryptocurrency wallet paths, and exfiltrates all data via raw-socket chunked POST to a hardcoded C2 at 193.143.1.131 in Russia.
GitHub Impersonation
1 post
Malicious GitHub Campaign: Fake “Arctic Wolf” and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer