Arctic Wolf Labs documented a campaign using more than 292 fake GitHub repositories that impersonate security, fintech, crypto, and gaming vendors to deliver a BoryptGrab-lineage infostealer. Repository READMEs route victims through GitHub Pages redirectors to fake download pages serving ZIP files that regenerate roughly every 60 seconds to defeat hash-based detection. A legitimately signed updater then side-loads a trojanized library. The campaign, which began June 26, 2026, abuses GitHub’s trust and search ranking to spread an in-memory credential and wallet stealer.
What is the fake-repo campaign?
The operation weaponizes GitHub’s credibility. A financially motivated actor stood up hundreds of repositories posing as well-known vendors, including a fake page impersonating a major security firm. Each repository’s README links out through GitHub Pages (github.io) redirectors to convincing download pages. The files served there are ZIP archives that the operators regenerate about once a minute, so no two victims necessarily download the same file hash. A validly signed WinGUP updater side-loads a trojanized libcurl library, executing the stealer in memory.
Why the 60-second rotation matters
Traditional detection often leans on file hashes: identify a malicious file once, block that hash everywhere. Regenerating the payload roughly every minute breaks that model, because the hash is stale almost as soon as it is catalogued. Combined with a legitimately signed updater carrying the malicious library, the campaign is engineered to slip past both signature checks and reputation systems. This is the same pressure that pushed the wider stealer market toward polymorphism, a trend we track across the top infostealer families of 2026.
What the stealer takes
Arctic Wolf assessed the payload as the BoryptGrab family: an in-memory stealer with 11 theft modules, a wallet-path table covering roughly 32 cryptocurrency wallet brands, and support for more than 19 browsers. Its command-and-control sat on Proton66 infrastructure in Russia. The harvested credentials and session cookies feed the same access economy that fuels ransomware, which is why exposed logins belong in a stealer-log check.
What defenders and developers should do
Treat GitHub search results and READMEs as untrusted delivery surfaces, not as endorsements. Download tools only from a vendor’s verified domain, not from a repository link chain. For defenders, behavior-based detection matters more than hashes here: watch for signed updaters side-loading unexpected libraries and for in-memory credential access. Block the reported distribution domains and C2, and rotate any credentials or wallet keys that may have touched an affected machine.
Frequently asked questions
How does the fake GitHub campaign avoid detection?
It regenerates the malicious ZIP roughly every 60 seconds so file hashes are constantly changing, and it uses a legitimately signed updater to side-load a trojanized library, defeating both hash and signature checks.
What is BoryptGrab?
BoryptGrab is the infostealer family Arctic Wolf attributed to the payload. It runs in memory with 11 theft modules and targets around 32 wallet brands and more than 19 browsers.
How many fake repositories were involved?
Arctic Wolf found more than 292 fake repositories, about 78 redirector accounts, and 20 distribution domains in the campaign, which began June 26, 2026.
Is GitHub itself compromised?
No. The attackers abuse GitHub’s hosting, trust, and search ranking by creating fake repositories and Pages redirectors. The platform is being used as a delivery surface, not breached.
What should I do if I downloaded a tool this way?
Assume credentials, browser sessions, and wallet keys on that machine are compromised. Rotate passwords, revoke sessions, move funds from exposed wallets, and run a full endpoint investigation.