Cybersecurity researchers have uncovered a large-scale campaign in which hundreds of GitHub repositories were made to look like legitimate software projects while actually distributing malware.
According to the report, the attackers created 292 fake repositories that impersonated security tools, developer utilities, macOS apps, games, and other popular software categories. Each repository included a polished README file that pushed visitors toward a download link on a separate malicious page. The tactic works because GitHub is widely trusted by developers and everyday users alike, making it an ideal place for criminals to hide harmful payloads behind a familiar interface.
The campaign is linked to a new variant of the BoryptGrab infostealer family, which is designed to silently collect sensitive data once installed. Researchers say the malware targets passwords, cookies, payment information, browser sessions, and wallet credentials from 19 browsers and 32 cryptocurrency wallets. It also steals data from Telegram, Discord, Steam, Windows Credential Manager, and other applications. One particularly concerning detail is that the malware can bypass Chrome’s App-Bound Encryption by using code injection, showing that the operators built the payload to defeat modern browser protections.
The attack appears to have begun in the last days of June, and most of the malicious repositories have now been removed. Even so, researchers noted that several dozen redirectors or related pages were still active at the time of reporting. That means users searching for free downloads or copies of premium tools could still stumble onto a fake repository or a spoofed landing page. The scale of the operation shows how quickly attackers can abuse open-source platforms when they know users are likely to trust project names, readmes, and download buttons without deeper verification.
For users and organizations, the lesson is simple: treat any unsolicited GitHub download with caution. Always verify that a project comes from the official developer or vendor, and avoid installing software from repositories that rely on hidden ZIP files or external download pages. Security teams should also monitor for unusual browser credential theft, wallet activity, and suspicious outbound connections tied to newly installed software. In a threat landscape where attackers can make malicious code look polished and professional, careful source verification is one of the best defenses available.
