Doctor Web published research dated 5 November 2026 titled 'Insolence beyond belief. Threat actors target information security developers on GitHub' saying infected GitHub repositories drew its researchers' attention after they found malware in Microsoft Visual Studio projects (.suo and .csproj files) as well as in Python and Go source files.

Doctor Web says the first infected repositories emerged about two years ago and initially targeted crypto-wallet users with Visual Studio projects related to blockchain games, bots and cheating tools; the attackers have now switched focus to information-security professionals, with malware in projects for scanning automation, security-system testing and log analysis, including a bogus repository advertised as a script to parse, clean and format output from the Fscan network scanner.

According to Doctor Web, once infected files are downloaded a PowerShell script runs, retrieves an encrypted download link and unpacks an Electron-based loader (Microsoft.exe, which Doctor Web detects as Trojan.Loader.3261) under a path such as C:\ProgramData\Windows.Microsoft.Photos; the loader elevates privileges, disables Windows Defender, UAC, notifications, System Restore and VSS, can try to remove ESET, McAfee or Malwarebytes, deploys a backdoor, clipper and data-theft trojan, and at the time of Doctor Web's research more than 2,000 PCs were infected.

Doctor Web says the attackers behind these compromised development projects target blockchain-game enthusiasts and, most recently, information-security professionals. (source: Doctor Web)

BleepingComputer reported the same campaign on 6 November 2026, attributing the findings to Dr.Web and describing six evasion techniques in the loader's default Mode3 (parent-process spoofing, Smart App Control registry change, ntdll unhooking, direct syscalls, ETW and AMSI patching). (source: BleepingComputer)