Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories
Operation Muck and Load: 222-repo GitHub lure network distributes malware via trojanized Go module and PowerShell
Summary
Researchers uncovered Operation Muck and Load, a coordinated malware campaign spanning 222 GitHub repositories across 190 accounts designed to distribute Windows malware through deceptive lures. The attack chain begins with a malicious Go module impersonating a DNS scanner, which executes hidden PowerShell that retrieves encrypted payloads from public dead-drop services (Pastebin, Telegram, YouTube, Google Docs), then deploys password-protected .7z archives containing RATs (AsyncRAT, Quasar, Remcos) and infostealers (Vidar). The GitHub infrastructure uses automated workflows tied to a threat-actor email to simulate active development across crypto wallets, game cheats, and bot repositories, creating a reputation layer that scales the attack surface.
Full text
Research/Security NewsFake Braintree NuGet Package Skims Credit Cards and Harvests Merchant CredentialsA malicious .NET package is typosquatting the Braintree SDK to steal live payment card data, merchant API keys, and host secrets from production apps. By Joseph Edwards - Jul 09, 2026
Indicators of Compromise
- domain — muckcoding.com
- domain — muckdeveloper.com
- url — https://muckcoding.com/LG-LW/Api-Certificate
- url — https://pastebin.com/raw/xy32SJgf
- url — https://rlim.com/MicrosoftCur/raw
- url — https://github.com/tb78/expresso/releases/download/Release/Quixo.7z
- email — ischhfd83@rambler.ru
- hash_sha256 — 73c807df26427d6631088a822fa54c30975afbe681a9d83eff5d19e5b075d6c2
- hash_sha256 — 969b0bfd605aa2cddf353f3638b0dee26b1c2305600231e055fa6d7786a879fe
- hash_sha256 — 4ea1c577247b149489506b230e7aa203e1a2fa124109c6056d1986e944f520a4
- malware — AsyncRAT
- malware — Quasar
- malware — Remcos
- malware — Vidar