--- title: What this "Fixed Version" is really doing? | daily.dev description: A malware campaign is targeting GitHub issue trackers across popular open source projects, including Claude Code's repository. Attackers post fake 'fix' links... canonical: https://daily.dev/posts/what-this-fixed-version-is-really-doing--wfcagitkj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What this "Fixed Version" is really doing? | daily.dev og:description: A malware campaign is targeting GitHub issue trackers across popular open source projects, including Claude Code's repository. Attackers post fake 'fix' links... og:url: https://daily.dev/posts/what-this-fixed-version-is-really-doing--wfcagitkj og:image: https://api.daily.dev/og/posts/WFcAGitkJ.png og:image:alt: What this "Fixed Version" is really doing? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What this "Fixed Version" is really doing? **[Eric Parker](https://daily.dev/sources/ericparker)** · 11 min read · 10 upvotes · 0 comments ## Summary A malware campaign is targeting GitHub issue trackers across popular open source projects, including Claude Code's repository. Attackers post fake 'fix' links in issue comments, leading victims to download a ZIP containing a legitimate Windows executable (MPDLP service) bundled with a malicious DLL. Analysis reveals the payload is a multi-stage info stealer (StealC and Vidor) that spawns hidden browser windows to bypass app-bound encryption, exfiltrates credentials, and uses Telegram as a resilient C2 fallback. The campaign spans many projects (Godot, data visualization tools, etc.) and uses newly created GitHub accounts. Defensive recommendations include common-sense URL scrutiny, application allowlisting tools like ThreatLocker, least-privilege access, and zero-trust architecture to limit blast radius from a single compromised endpoint. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What malware is being spread through fake fix files in GitHub issues for Claude Code and other projects? A malicious zip disguised as a bug fix bundles a legitimate Microsoft DLP service executable with a trojanized mpclient.dll. When run, it spawns hidden Chrome and Edge windows to deploy the StealC and Vidor info stealers, which exfiltrate credentials and communicate with a command-and-control server via a domain hidden behind a Telegram redirect. _Track fast-moving supply chain and issue-tracker malware campaigns like this one with daily.dev before your team gets caught out._ ### How does the StealC malware bypass Chrome's app-bound encryption to steal saved credentials? StealC spawns a hidden Microsoft Edge window instead of directly copying Chrome's encrypted credential files, sidestepping the app-bound encryption protection Google added specifically to stop info stealers from lifting saved data. This lets the malware access and exfiltrate stored logins despite that protection being in place. _Developers hardening browser-based credential storage can follow evolving stealer bypass techniques on daily.dev._ ### How can I tell if a 'fix' zip file posted in a GitHub issue comment is malware? Warning signs include a blank zip with no explanation of what it does, a randomly or blandly named binary, links posted by newly created accounts, and generic-looking download URLs. Legitimate fixes, especially for open source projects, typically include context describing what the fix changes rather than shipping an unexplained binary. _Developers vetting suspicious issue-tracker links can stay ahead of these scams by following security writeups on daily.dev._ ## Similar posts on daily.dev - [Claude Code Packaging Error Remains a Lure in an Active Campaign: What Defenders Should Do](https://daily.dev/posts/claude-code-packaging-error-remains-a-lure-in-an-active-campaign-what-defenders-should-do-xempao11e) · Trend Micro · 0 upvotes · 0 comments - [Widespread GitHub Campaign Uses Fake VS Code Security Alerts...](https://daily.dev/posts/widespread-github-campaign-uses-fake-vs-code-security-alerts--bpmrd5akt) · Socket · 2 upvotes · 0 comments - [Fake Claude Code source downloads actually delivered malware](https://daily.dev/posts/fake-claude-code-source-downloads-actually-delivered-malware-5gamzwr6l) · The Register · 1 upvotes · 0 comments - [ClickFix techniques evolve in new infostealer campaigns](https://daily.dev/posts/clickfix-techniques-evolve-in-new-infostealer-campaigns-mufrpsfhw) · CSO Online · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#github](https://daily.dev/tags/github), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/what-this-fixed-version-is-really-doing--wfcagitkj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What this \"Fixed Version\" is really doing?","url":"https://daily.dev/posts/what-this-fixed-version-is-really-doing--wfcagitkj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-this-fixed-version-is-really-doing--wfcagitkj"},"datePublished":"2026-07-17T15:29:01.333Z","dateModified":"2026-09-14T08:02:47.927Z","description":"A malware campaign is targeting GitHub issue trackers across popular open source projects, including Claude Code's repository. Attackers post fake 'fix' links...","image":"https://i.ytimg.com/vi/z__8QXXKmjE/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/z__8QXXKmjE/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Eric Parker","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Eric Parker","logo":"https://media.daily.dev/image/upload/s--vVcOpkjx--/f_auto/v1724391603/logos/ericparker","url":"https://daily.dev/sources/ericparker"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-this-fixed-version-is-really-doing--wfcagitkj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":10},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,github,malware","timeRequired":"PT11M","video":{"@type":"VideoObject","name":"What this \"Fixed Version\" is really doing?","description":"A malware campaign is targeting GitHub issue trackers across popular open source projects, including Claude Code's repository. Attackers post fake 'fix' links...","thumbnailUrl":"https://i.ytimg.com/vi/z__8QXXKmjE/sddefault.jpg","uploadDate":"2026-07-17T15:29:01.333Z","duration":"PT11M","url":"https://api.daily.dev/r/WFcAGitkJ","embedUrl":"https://www.youtube.com/embed/z__8QXXKmjE"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Eric Parker","item":"https://daily.dev/sources/ericparker"},{"@type":"ListItem","position":3,"name":"What this \"Fixed Version\" is really doing?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-this-fixed-version-is-really-doing--wfcagitkj#faq","mainEntity":[{"@type":"Question","name":"What malware is being spread through fake fix files in GitHub issues for Claude Code and other projects?","acceptedAnswer":{"@type":"Answer","text":"A malicious zip disguised as a bug fix bundles a legitimate Microsoft DLP service executable with a trojanized mpclient.dll. When run, it spawns hidden Chrome and Edge windows to deploy the StealC and Vidor info stealers, which exfiltrate credentials and communicate with a command-and-control server via a domain hidden behind a Telegram redirect. Track fast-moving supply chain and issue-tracker malware campaigns like this one with daily.dev before your team gets caught out."}},{"@type":"Question","name":"How does the StealC malware bypass Chrome's app-bound encryption to steal saved credentials?","acceptedAnswer":{"@type":"Answer","text":"StealC spawns a hidden Microsoft Edge window instead of directly copying Chrome's encrypted credential files, sidestepping the app-bound encryption protection Google added specifically to stop info stealers from lifting saved data. This lets the malware access and exfiltrate stored logins despite that protection being in place. Developers hardening browser-based credential storage can follow evolving stealer bypass techniques on daily.dev."}},{"@type":"Question","name":"How can I tell if a 'fix' zip file posted in a GitHub issue comment is malware?","acceptedAnswer":{"@type":"Answer","text":"Warning signs include a blank zip with no explanation of what it does, a randomly or blandly named binary, links posted by newly created accounts, and generic-looking download URLs. Legitimate fixes, especially for open source projects, typically include context describing what the fix changes rather than shipping an unexplained binary. Developers vetting suspicious issue-tracker links can stay ahead of these scams by following security writeups on daily.dev."}}]} ```