Fake GitHub repositories spread the BoryptGrab infostealer

Arctic Wolf Labs has identified at least 292 GitHub repositories impersonating software and security brands, including Arctic Wolf itself, to distribute a Windows information stealer related to BoryptGrab. The repositories copy legitimate branding, use search engine optimisation to attract victims and route visitors through deceptive download pages to malicious ZIP archives. The infection chain commonly uses DLL side-loading or script-based downloaders. BoryptGrab is a C/C++ information stealer first tracked by Trend Micro after related activity emerged in 2025. It collects passwords, cookies and other data from Chromium- and Firefox-based browsers, including information protected by Chrome's App-Bound Encryption. It also targets desktop and browser-based cryptocurrency wallets, Telegram data, Discord tokens, system information and files in common directories, while capturing screenshots and recording installed applications. Arctic Wolf assesses the campaign as financially motivated and driven by search traffic rather than targeting a specific sector. The activity abuses trust in GitHub and well-known brands; it does not exploit a vulnerability in the impersonated products.

What this means for your organisation

What is being exploited here is an entirely ordinary working habit: an employee searches for a tool, finds it immediately and downloads it. GitHub reads as a safe source, and the result sits at the top of the page. Once an information stealer runs, the problem is not the one machine but every credential stored in the browser, including access to cloud services you assumed were protected by multi-factor authentication.

Berigo recommends

• Limit who can install software themselves, and provide a simple, fast route for requesting new tools.
• Give staff one short rule: download from the vendor's own domain, not from a search result.
• Treat an infostealer infection as compromise of every stored credential and reset them, rather than only cleaning the machine.
• Monitor for sign-ins from new devices and unusual locations for accounts used on an affected machine.

Source

• arcticwolf.com
• trendmicro.com