Trusted Design

GitHub Impersonation Deploys Information Stealer

概要

An internal security operations team identified a fraudulent GitHub page impersonating a cybersecurity vendor to target customers and the general public. The malicious page appeared legitimate by referencing authentic services and operational requirements. While the GitHub page itself contained non-malicious content, a disguised link led victims to download a ZIP archive containing malicious executables. The attack chain deployed BoryptGrab Stealer information-stealing malware through DLL side-loading techniques. Investigation revealed nearly 300 similar repositories impersonating well-known organizations including Malwarebytes, Bitdefender, and 360 Total Security, using SEO keywords to attract victims. The malicious page has been removed and detection capabilities have been enhanced.

Created: 2026-07-03

Indicators

• URL - https://github.com/antivirus-free-bitdefender -
• FileHash-MD5 - fd01262bd56510088b9ddfe58ca101ab -
• URL - https://github.com/malwarebytes-protection -
• FileHash-MD5 - b98575f3c0259b480a31b917aa73bc56 -
• URL - https://bentleyvazquezpvey.github.io/.github/ -
• URL - https://github.com/Arctic-Wolf-Security -

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る