Dr.Web's Own Report on the Fake GitHub Security Tools Lists Four Domains and One IP. All Five Are in Our Feed at 70, and Our Edge Has Never Seen the IP.
If you build downloaded security helpers on Windows, add five network indicators to your blocklist and look for three file paths on any machine that built one. Our earlier post on this campaign rested on news retellings and had no indicators. Doctor Web's own report, dated November 5, 2026, is now in hand, so this post adds what that report lists and what our edge says about it.
What Doctor Web lists
The report finds malicious code in Visual Studio projects, in .csproj files (a PreBuildEvent that runs before compilation) and .suo files, and in Python and Go files where the code sits behind long runs of whitespace. It says more than 2,000 PCs were infected when its researchers looked. The first infected repositories appeared two years ago, aimed at crypto wallet users through blockchain game, bot and cheat projects, and the operators now aim at information security professionals with scanning, testing and log-analysis lures, including a fake Fscan output parser.
Doctor Web lists these addresses as associated with the attackers, found in the fake repositories: muckanthropic.com, muckduck.duckdns.org, muckcoding.com, muckdeveloper.com and 130.12.182.172. The report does not say what role each plays, whether lure, staging or command and control.
What it looks like on a machine
- A PowerShell script saved as C:\Users\Public\Pictures\t.ps1 or L.ps1. It can query the attackers' servers and legitimate services including YouTube, Telegram, Google Docs, GitCode and Pastebin, and an encrypted string it fetches decodes to a download link.
- An archive named Quixo.7z, unpacked to C:\ProgramData\Windows.Microsoft.Photos. It holds an Electron application, Microsoft.exe, which Doctor Web detects as Trojan.Loader.3261.
- A second archive, Nexara.7z, with the encrypted payload, and Nexara/Nvdia.7z with an Electron stealer detected as JS.Stealer.191.
- Changes to the hosts file, and deletion of files in the etc folder other than hosts, networks, protocol, services and lmhosts.sam. Doctor Web says this blocks antivirus vendors' domains and prevents backups.
- Removed or disabled security: McAfee, ESET and Malwarebytes uninstalled, and Defender, UAC, System Restore and VSS turned off, with Defender exclusions for regasm.exe and dwm.exe.
- Injection into RegAsm.exe, dwwin.exe or dwm.exe. The payloads are two copies of AsyncRAT on different ports, which Doctor Web guesses lets two operators control one device, and a clipper that swaps wallet addresses while sending screenshots to a Telegram bot.
The stealer takes browser data, FileZilla XML files, MobaXterm.ini, Total Commander's wcx_ftp.ini, VPN settings, messenger files, game accounts and Discord tokens. Data goes out through the Telegram bot.
What our edge and feed say
We checked all five against our own instruments on November 7.
- Feed: none of the five was in our corpus before this morning.
- Edge blocks, decoys and origin: for the IP, zero matches in 47,542 block records, 24,984 decoy hits and 977 origin captures since October 8. That is a measurement over a window. It is not proof nobody connected, because these only see traffic aimed at our sites, and a malware server mostly receives connections, not sends them.
- The same /24: a different address, 130.12.182.254, is in our corpus as a configuration-file scanner seen at our decoys in July and September. It is on the same network, Netiface LLC. That is adjacency only. It does not link that scanner to this campaign.
- The IP itself: Shodan's InternetDB maps the hostname muckduck.duckdns.org to 130.12.182.172, which supports the report's linking of the two. AbuseIPDB has no reports on it, so no other community has flagged it.
We added all five to the feed at confidence 70 under manual-batch-fake-github-security-tools-2026-11 and read them back 5 of 5. That is below the 80 our own edge shield needs before blocking, so they ship to default subscribers but we do not block them ourselves. They are cited from Doctor Web, not our sighting. The domain muckduck.duckdns.org is a subdomain of a dynamic DNS service: the hostname is the indicator, and nobody should block duckdns.org.
Corrections to our earlier post
The first post said no indicators were available to us and none were ingested. That was true of the sources we had read, and it is now out of date. It also repeated, as unresolved, one retelling's espionage label. Doctor Web's report describes crypto-wallet clipping and credential theft and does not use that word.
Limits
We read the text of Doctor Web's report as provided to us. We did not open its indicator page, so file hashes are missing here, and we did not retrieve the report's link: the feed records cite Doctor Web's news site, not a deep link. We did not test any sample or visit any listed host.
Five percent of this is wrong somewhere. It always is. Doctor Web's indicator page will correct a role or add the hashes.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.