Executive Summary
Security researchers have identified a sophisticated campaign targeting information security professionals and blockchain developers through poisoned GitHub repositories. The attackers embed malicious code within common development files, such as Microsoft Visual Studio projects (.suo and .csproj), as well as Python and Go source files. When a developer clones and builds these projects, a multi-stage infection process begins, leading to the deployment of backdoors, data stealers, and cryptocurrency clippers.
The technical execution is notably advanced, utilizing an Electron-based loader (Trojan.Loader.3261) that employs multiple evasion techniques. These include PPID spoofing, Ntdll.dll unhooking, and direct syscall execution (Halo's Gate) to bypass EDR and Smart App Control. The malware also actively sabotages defense mechanisms by attempting to uninstall established antivirus software and modifying the hosts file to block security vendor domains.
This campaign is significant due to its specific targeting of high-value users—security researchers and developers—who may possess sensitive access or credentials. With over 2,000 confirmed infections, the impact spans credential theft, source code exposure, and financial loss via crypto-clipping. Organizations should audit developer activities on GitHub and ensure that local build environments are strictly monitored for unexpected PowerShell execution.