--- title: Malicious GitHub Campaign: Fake “Arctic Wolf” and 290+... description: Since late June 2026, an unattributed threat actor has published at least 292 brand-impersonation GitHub repositories mimicking legitimate software vendors —... canonical: https://daily.dev/posts/malicious-github-campaign-fake-arctic-wolf-and-290-brand-impersonation-repositories-deliver-bory-pfw4ug3ql twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Malicious GitHub Campaign: Fake “Arctic Wolf” and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer | daily.dev og:description: Since late June 2026, an unattributed threat actor has published at least 292 brand-impersonation GitHub repositories mimicking legitimate software vendors —... og:url: https://daily.dev/posts/malicious-github-campaign-fake-arctic-wolf-and-290-brand-impersonation-repositories-deliver-bory-pfw4ug3ql og:image: https://api.daily.dev/og/posts/pFW4ug3Ql.png og:image:alt: Malicious GitHub Campaign: Fake “Arctic Wolf” and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Malicious GitHub Campaign: Fake “Arctic Wolf” and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer **[Arctic Wolf](https://daily.dev/sources/arcticwolf)** · 35 min read · 3 upvotes · 0 comments ## Summary Since late June 2026, an unattributed threat actor has published at least 292 brand-impersonation GitHub repositories mimicking legitimate software vendors — including a fake Arctic Wolf page — to distribute a Windows infostealer linked to the BoryptGrab malware family. Each repo hosts a marketing-style README with a concealed link routing victims through github.io redirectors to a fake 'secure download' page. The payload uses DLL side-loading: a legitimate signed WinGUP updater loads a trojanized libcurl.dll, which decodes and reflectively executes an in-memory infostealer via COM/SafeArray staging. The stealer runs 11 sequential theft modules targeting 19+ browsers (including a Chrome App-Bound Encryption v20 bypass via reflective DLL injection), Telegram, Discord, Meta Max, Steam (via process memory scanning), 41 cryptocurrency wallet paths, desktop files, screenshots, and Windows Credential Manager. Stolen data is exfiltrated via raw Winsock POST to a hardcoded C2 on Proton66 (Russia). Binary-level analysis confirms shared codebase with BoryptGrab (1,638 matched functions, BinDiff score 0.40), though five architectural divergences suggest a distinct operator or separate build. The campaign exploits user trust rather than any software vulnerability. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the BoryptGrab-lineage infostealer bypass Chrome's App-Bound Encryption v20 without writing files to disk? It injects an embedded ~134KB DLL directly into the browser's own process via CreateRemoteThread after launching the browser with CreateProcessW and allocating memory with VirtualAllocEx. The injected code calls the App-Bound elevation COM service from within the browser's trusted process space, then writes the decrypted master key to a named shared-memory region for the stealer to read, avoiding any disk-based helper or network download. _Teams hardening browser credential storage can track emerging bypass techniques like this one on daily.dev._ ### What browsers and applications does the BoryptGrab-lineage stealer target for credential theft? It targets 19+ browsers including Chrome, Edge, Brave, Yandex, Vivaldi, Opera, Firefox, and previously undocumented ones like Amigo and QQBrowser, plus Telegram, Discord (three release channels), Meta Max messenger, Steam (via process-memory scanning), and Windows Credential Manager. It also scans for a 41-entry cryptocurrency wallet path table covering roughly 32 wallet brands. _Defenders scoping credential-theft exposure can follow detailed malware capability breakdowns like this on daily.dev._ ### How is the malicious payload delivered through fake GitHub repositories in this brand-impersonation campaign? Attackers create throwaway GitHub accounts hosting a .github repository with a marketing-styled README containing a concealed link that routes through a *.github.io redirector to an actor-controlled distribution domain, then to a templated fake secure-download page. Clicking download hits a /download-archive endpoint that generates a branded ZIP roughly every 60 seconds containing a legitimate signed WinGUP updater that side-loads a trojanized libcurl.dll to run the stealer in memory. _Developers evaluating GitHub supply-chain risks can keep up with campaign breakdowns like this on daily.dev._ ## Similar posts on daily.dev - [GitHub Impersonation Deploys Information Stealer](https://daily.dev/posts/github-impersonation-deploys-information-stealer-fm6cyj2u0) · Arctic Wolf · 0 upvotes · 0 comments - [New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages](https://daily.dev/posts/new-boryptgrab-stealer-targets-windows-users-via-deceptive-github-pages-yrwqhjw1f) · Trend Micro · 0 upvotes · 0 comments - [Operation RepoGhost: Exposing a Russian-Linked Malware Campaign Hiding in GitHub’s Open-Source Ecosystem](https://daily.dev/posts/operation-repoghost-exposing-a-russian-linked-malware-campaign-hiding-in-github-s-open-source-ecosy-otywwtpum) · InfoSec Write-ups · 15 upvotes · 4 comments - [Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer](https://daily.dev/posts/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer-a8pqgzb0a) · BleepingComputer · 9 upvotes · 2 comments - [Fake Claude Code source downloads actually delivered malware](https://daily.dev/posts/fake-claude-code-source-downloads-actually-delivered-malware-5gamzwr6l) · The Register · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#github](https://daily.dev/tags/github), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/malicious-github-campaign-fake-arctic-wolf-and-290-brand-impersonation-repositories-deliver-bory-pfw4ug3ql) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious GitHub Campaign: Fake “Arctic Wolf” and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer","url":"https://daily.dev/posts/malicious-github-campaign-fake-arctic-wolf-and-290-brand-impersonation-repositories-deliver-bory-pfw4ug3ql","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/malicious-github-campaign-fake-arctic-wolf-and-290-brand-impersonation-repositories-deliver-bory-pfw4ug3ql"},"datePublished":"2026-07-13T22:46:53.919Z","dateModified":"2026-09-14T09:27:21.488Z","description":"Since late June 2026, an unattributed threat actor has published at least 292 brand-impersonation GitHub repositories mimicking legitimate software vendors —...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/36b1199b017ca6d85aef39e25603096f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/36b1199b017ca6d85aef39e25603096f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Arctic Wolf","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Arctic Wolf","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/30920b37616d4d80ad2b810a4b9f6b2e","url":"https://daily.dev/sources/arcticwolf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/malicious-github-campaign-fake-arctic-wolf-and-290-brand-impersonation-repositories-deliver-bory-pfw4ug3ql","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,github,malware","timeRequired":"PT35M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Arctic Wolf","item":"https://daily.dev/sources/arcticwolf"},{"@type":"ListItem","position":3,"name":"Malicious GitHub Campaign: Fake “Arctic Wolf” and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/malicious-github-campaign-fake-arctic-wolf-and-290-brand-impersonation-repositories-deliver-bory-pfw4ug3ql#faq","mainEntity":[{"@type":"Question","name":"How does the BoryptGrab-lineage infostealer bypass Chrome's App-Bound Encryption v20 without writing files to disk?","acceptedAnswer":{"@type":"Answer","text":"It injects an embedded ~134KB DLL directly into the browser's own process via CreateRemoteThread after launching the browser with CreateProcessW and allocating memory with VirtualAllocEx. The injected code calls the App-Bound elevation COM service from within the browser's trusted process space, then writes the decrypted master key to a named shared-memory region for the stealer to read, avoiding any disk-based helper or network download. Teams hardening browser credential storage can track emerging bypass techniques like this one on daily.dev."}},{"@type":"Question","name":"What browsers and applications does the BoryptGrab-lineage stealer target for credential theft?","acceptedAnswer":{"@type":"Answer","text":"It targets 19+ browsers including Chrome, Edge, Brave, Yandex, Vivaldi, Opera, Firefox, and previously undocumented ones like Amigo and QQBrowser, plus Telegram, Discord (three release channels), Meta Max messenger, Steam (via process-memory scanning), and Windows Credential Manager. It also scans for a 41-entry cryptocurrency wallet path table covering roughly 32 wallet brands. Defenders scoping credential-theft exposure can follow detailed malware capability breakdowns like this on daily.dev."}},{"@type":"Question","name":"How is the malicious payload delivered through fake GitHub repositories in this brand-impersonation campaign?","acceptedAnswer":{"@type":"Answer","text":"Attackers create throwaway GitHub accounts hosting a .github repository with a marketing-styled README containing a concealed link that routes through a *.github.io redirector to an actor-controlled distribution domain, then to a templated fake secure-download page. Clicking download hits a /download-archive endpoint that generates a branded ZIP roughly every 60 seconds containing a legitimate signed WinGUP updater that side-loads a trojanized libcurl.dll to run the stealer in memory. Developers evaluating GitHub supply-chain risks can keep up with campaign breakdowns like this on daily.dev."}}]} ```