Since late June 2026, an unattributed threat actor has published at least 292 brand-impersonation GitHub repositories mimicking legitimate software vendors — including a fake Arctic Wolf page — to distribute a Windows infostealer linked to the BoryptGrab malware family. Each repo hosts a marketing-style README with a concealed link routing victims through github.io redirectors to a fake 'secure download' page. The payload uses DLL side-loading: a legitimate signed WinGUP updater loads a trojanized libcurl.dll, which decodes and reflectively executes an in-memory infostealer via COM/SafeArray staging. The stealer runs 11 sequential theft modules targeting 19+ browsers (including a Chrome App-Bound Encryption v20 bypass via reflective DLL injection), Telegram, Discord, Meta Max, Steam (via process memory scanning), 41 cryptocurrency wallet paths, desktop files, screenshots, and Windows Credential Manager. Stolen data is exfiltrated via raw Winsock POST to a hardcoded C2 on Proton66 (Russia). Binary-level analysis confirms shared codebase with BoryptGrab (1,638 matched functions, BinDiff score 0.40), though five architectural divergences suggest a distinct operator or separate build. The campaign exploits user trust rather than any software vulnerability.
