--- title: "What this \"Fixed Version\" is really doing?" url: https://daily.dev/posts/what-this-fixed-version-is-really-doing--wfcagitkj source_url: https://www.youtube.com/watch?v=z__8QXXKmjE type: video:youtube source: "Eric Parker" published: 2026-07-17T15:29:01.333Z updated: 2026-07-17T15:29:23.059Z tags: ["cyber", "github", "malware"] reading_time: 11 upvotes: 10 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What this "Fixed Version" is really doing? **[Eric Parker](https://daily.dev/sources/ericparker)** · 11 min read · 10 upvotes · 0 comments ## Summary A malware campaign is targeting GitHub issue trackers across popular open source projects, including Claude Code's repository. Attackers post fake 'fix' links in issue comments, leading victims to download a ZIP containing a legitimate Windows executable (MPDLP service) bundled with a malicious DLL. Analysis reveals the payload is a multi-stage info stealer (StealC and Vidor) that spawns hidden browser windows to bypass app-bound encryption, exfiltrates credentials, and uses Telegram as a resilient C2 fallback. The campaign spans many projects (Godot, data visualization tools, etc.) and uses newly created GitHub accounts. Defensive recommendations include common-sense URL scrutiny, application allowlisting tools like ThreatLocker, least-privilege access, and zero-trust architecture to limit blast radius from a single compromised endpoint. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Claude Code Packaging Error Remains a Lure in an Active Campaign: What Defenders Should Do](https://daily.dev/posts/claude-code-packaging-error-remains-a-lure-in-an-active-campaign-what-defenders-should-do-xempao11e) · Trend Micro · 0 upvotes · 0 comments - [Widespread GitHub Campaign Uses Fake VS Code Security Alerts...](https://daily.dev/posts/widespread-github-campaign-uses-fake-vs-code-security-alerts--bpmrd5akt) · Socket · 2 upvotes · 0 comments - [InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise](https://daily.dev/posts/installfix-and-claude-code-how-fake-install-pages-lead-to-real-compromise-59a8rabab) · Trend Micro · 0 upvotes · 0 comments - [Fake Claude Code source downloads actually delivered malware](https://daily.dev/posts/fake-claude-code-source-downloads-actually-delivered-malware-5gamzwr6l) · The Register · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#github](https://daily.dev/tags/github), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/what-this-fixed-version-is-really-doing--wfcagitkj)