[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fh_zKjDKBVppGaK2_lxByG40p-xJ-nNH6y3BJn-3okKQ":3},{"article":4,"iocs":57},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":34,"category":35,"article_tags":39},"3c721b76-9bb2-48c1-b046-9d9492aeaa8d","Network of 200 GitHub Repositories Used for Malware Infection","network-of-200-github-repositories-used-for-malware-infection-9ad822","A Go module is used to load PowerShell code that fetches a resolver from public dead drops to execute Windows malware. The post Network of 200 GitHub Repositories Used for Malware Infection appeared first on SecurityWeek.","A threat actor, dubbed 'Operation Muck and Load,' has established a network of over 200 GitHub repositories to distribute Windows malware. The campaign utilizes a Go module, disguised as a DNS scanning tool, to load PowerShell code that fetches and executes various malware types, including spyware, infostealers, and cryptominers. The actor employs multiple public platforms for hosting encrypted payloads, ensuring operational resilience.","Operation Muck and Load uses 200+ GitHub repos to deliver Windows malware via Go modules.","A threat actor has built a network of over 200 GitHub repositories that have been delivering Windows malware, supply chain protection provider Socket reports. Dubbed Operation Muck and Load, the campaign involves 222 lure repositories across 190 accounts that contain a Go module designed to trigger the infection chain. The module, Socket explains, loads PowerShell code that fetches a resolver from public dead drops to execute Windows malware such as spyware, trojan downloaders, infostealers, and cryptominers. To deceive users, the Go module poses as a DNS\u002Fsubdomain scanning tool built around the legitimate dnsub open source project. Since January 24, 2026, the threat actor has published over 1,200 versions of the package, 700 of which are malicious. “The likely cause is not normal release engineering, but the threat actor’s own GitHub Actions workflow repeatedly generating timestamp commits that could be surfaced as Go pseudo-versions,” Socket notes. The module contains a PowerShell command that runs before any scanning logic and is hidden using excessive horizontal whitespace. It fetches a PowerShell script executed in a way that evades script-execution policy restrictions.Advertisement. Scroll to continue reading. In turn, the script fetches from public dead drops a payload that acts as a resolver, downloader, extractor, and launcher. It locates encrypted payload metadata, decrypts a URL, retrieves a password-protected archive, extracts it, and executes its contents. Instead of using a single hardcoded payload URL, the threat actor behind Operation Muck and Load uses multiple public platforms to host mirrored encrypted resolver material for operational resilience. “The public sources are the dead-drop locations embedded in the script, including Pastebin, Rlim, Muck-themed infrastructure, and fallback locations on public platforms such as YouTube, Instagram, Telegram, Google Docs, and GitCode,” Socket explains. Payloads deployed at the end of the execution chain include AsyncRAT, Quasar RAT, a Remcos-style RAT, infostealers, and spyware. While most of the repositories associated with Operation Muck and Load acted as lures, others also delivered malware, either embedded into source trees or through GitHub release assets. “We identified at least 14 unique confirmed malware files across the analyzed threat actor workflow repositories. The confirmed payload set included trojan loaders and downloaders, Vidar infostealer, dropper\u002Fspyware payloads, and XMRig\u002FBitMiner-related Monero cryptominers,” Socket notes. Operation Muck and Load, the cybersecurity firm notes, overlaps with previously observed activity associated with the ‘ischhfd83’ email address, which also included Muck-themed domains. Related: North Korean Hackers Target Open Source Developers in Supply Chain Attacks Related: China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors Related: Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages Related: New ‘Mistic’ RAT Opens Door to Several Ransomware Families Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Chrome 150 Update Patches 27 Vulnerabilities8Layers Raises $2.9 Million for Identity Security PlatformUnpatched Backdoor in Tenda Firmware Grants Admin Access to DevicesAccenture Confirms Data Breach After Hacker Claims Source Code TheftChina-Linked APT Expands Arsenal With New ‘Leash’ BackdoorsGoogle Dialogflow CX Bug Allowed Attackers to Hijack AI ConversationsCISA Urges Immediate Patching of Exploited ColdFusion, Langflow, Joomla FlawsCritical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection Latest News QIZ Security Raises $17 Million for Cryptographic Governance PlatformUK Government Rolls Out Agentic AI Defense Plan Alongside Industry PledgePalo Alto Networks Patches 13 Vulnerabilities12 Million Impacted by Data Breach at Japanese Telco KDDI15-Year-Old Linux Vulnerability ‘GhostLock’ Earns Researchers $92k From GoogleMicrosoft Patches Defender ‘RoguePlanet’ VulnerabilityMount Royal University Confirms Data Stolen in Ransomware AttackAI Coding Tools Tricked Into Hacking Developer Machine via Decades-Old Technique Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Why Email Security Keeps Failing (And What Has to Change) July 8, 2026 Join this live webinar as we break down why email-layer defenses alone can't keep pace with the modern phishing ecosystem, how agentic AI is changing the capacity equation for security teams, and more. Register Virtual Event: 2026 Cloud Security Summit July 16, 2026 This year's summit will help organizations learn how to utilize tools, controls, and design models needed to properly secure cloud environments. Interact with leading solution providers and other end users facing similar challenges in securing a variety of cloud deployments. Register People on the MoveSolana Foundation has appointed Michael Coates as Chief Information Security Officer.Michael Sikorski has joined Coinbase as Chief Information Security Officer.WatchGuard has named Vincent Hwang as Chief Product Officer.More People On The MoveExpert Insights The Shift Toward Business-Aligned Risk Management Moving from isolated, technical data to a continuous risk lifecycle can help organizations align security controls with actual business consequences. (Steve Durbin) How to Conduct a Successful Audit of AI-Driven Software Development As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production. (Matias Madou) Frontier AI: Six Questions Every Enterprise Should Ask Security Vendors From model selection and automation to validation and measurable results, the right questions can help enterprises separate genuine AI capabilities from marketing hype. (Joshua Goldfarb) The AI Token Costs That Can Break Cybersecurity As cybersecurity platforms embrace agentic AI, organizations must balance detection performance against the escalating costs of token consumption, deployment architecture, and AI credits. (Danelle Au) When Information Becomes the Attack Surface – Understanding AI Agent Traps From hidden content injections to cognitive state poisoning, attackers are turning trusted data sources into traps for autonomous AI. (Etay Maor) Flipboard Reddit Whatsapp Whatsapp Email","https:\u002F\u002Fwww.securityweek.com\u002Fnetwork-of-200-github-repositories-used-for-malware-infection\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F11\u002FNPM-code-software-development.jpeg","2026-07-10T08:00:14+00:00","2026-07-10T08:00:20.746252+00:00",8,[18,21,24,27,29,32],{"name":19,"type":20},"Operation Muck and Load","campaign",{"name":22,"type":23},"Socket","vendor",{"name":25,"type":26},"Go module","technology",{"name":28,"type":26},"PowerShell",{"name":30,"type":31},"dnsub","product",{"name":33,"type":26},"open source","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":34,"icon":36,"name":37,"slug":38},null,"Supply Chain","supply-chain",[40,42,47,52],{"category":41},{"id":34,"icon":36,"name":37,"slug":38},{"category":43},{"id":44,"icon":36,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":36,"name":50,"slug":51},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":53},{"id":54,"icon":36,"name":55,"slug":56},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[58,61,63,66,68],{"type":46,"value":59,"context":60},"AsyncRAT","Payload deployed by Operation Muck and Load",{"type":46,"value":62,"context":60},"Quasar RAT",{"type":46,"value":64,"context":65},"Vidar infostealer","Confirmed payload found in threat actor repositories",{"type":46,"value":67,"context":65},"XMRig",{"type":46,"value":69,"context":65},"BitMiner"]