Nearly 300 GitHub repos pose as legit software to push malware

A threat actor has created nearly 300 fake GitHub repositories impersonating legitimate software projects to distribute an infostealer malware, primarily targeting credentials, cryptocurrency wallets, and sensitive data from browsers and messaging apps. The malicious repositories redirect users to spoofed download pages that deliver trojanized payloads, including a malicious libcurl.dll that executes the infostealer in memory. The malware, a variant of BoryptGrab, exfiltrates stolen data to a Russia-based C2 server and is designed for maximum data theft in a single execution without establishing persistence or anti-analysis measures.

AI-extracted · verify before operational use