TLDR Tech / InfoSec
Malicious GitHub Campaign: Fake "Arctic Wolf" and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer
Since June 26, a likely Russian-speaking actor has operated 292+ GitHub repositories impersonating brands, including a fake Arctic Wolf page. Victims are redirected via *.github.io to a controlled domain like targetroyena[.]com, where a spoofed secure download page serves a ZIP with a legitimate WinGUP updater that DLL side-loads a trojanized libcurl.dll. It decodes and reflectively executes an in-memory BoryptGrab infostealer, targeting browsers, messaging apps, crypto wallets, and Windows Credential Manager, then exfiltrates data via raw Winsock POST to a C2 server (Proton66, Russia). BinDiff shows 94% function overlap with BoryptGrab, suggesting the same operator. Defenders should enforce verified downloads, block egress to 193.143/24, hunt for unsigned libcurl.dll, monitor browser/Steam process injection, and treat uncleaned staging folders as indicators for credential and wallet rotation.
Read the full story