Operation RepoGhost: Exposing a Russian-Linked Malware Campaign Hiding in GitHub’s Open-Source…

Summary

Introduction:- Researchers at Avyukt Security have uncovered an ongoing malicious campaign we’ve dubbed Operation RepoGhost. Active since at least mid-November 2025, the threat actors behind it have built and maintained a sprawling network of fake and malicious GitHub repositories impersonating legitimate IT-related software and projects spanning AI, cybersecurity, Web3, cryptography, and other technical domains. Each repository is designed to look convincing enough that a visitor will download and execute the code inside it. Once run, the payload ultimately compromises the victim with a custom-built Go-based information stealer. Over the course of our investigation, we identified 52 malicious GitHub repositories tied to this campaign. Mapping and analyzing them gave us a clear picture of how the operation has evolved — both in its GitHub-based distribution tactics and its underlying malware arsenal. The campaign began with CountLoader, an infostealer targeting Windows systems, later expanded to include the Nova macOS infostealer, and has since consolidated around a custom Go-based infostealer as its current and most active payload. This research builds on prior work published by 陳禹璿 on Medium, who first documented related malicious activity involving GitHub repositories. We expand on those findings by identifying additional malicious repositories and IOCs, providing a deeper technical analysis of the Go-based infostealer, and correlating the malware evolution with the broader infrastructure behind the campaign to build a more complete picture of the operation and how it has progressed over time. Campaign Summary:-

• We assess that Operation RepoGhost began around November 2025, when the threat actors deployed the initial stage of the operation, primarily relying on CountLoader to compromise Windows hosts. Around January 2026, the operation expanded to target macOS users, with a new set of repositories distributing the Nova macOS infostealer.
• By June 2026, the threat actors had phased out CountLoader entirely and transitioned to a custom Go-based infostealer. The malware injects an obfuscated .NET assembly directly into memory and is capable of stealing Discord session tokens, browser-stored sessions and credentials, active Telegram and Steam sessions, cryptocurrency wallet data, and other sensitive information.
• The current iteration of the campaign no longer includes the macOS branch — the threat actors have fully consolidated around the Go-based infostealer as their primary payload.
• Based on the malware tradecraft observed and evidence uncovered while reverse engineering the .NET assembly, we assess with moderate to high confidence that Operation RepoGhost is operated by Russian-linked threat actors.
• In total, we identified 52 malicious GitHub repositories tied to the campaign, many of which remained publicly accessible and actively exposed to potential victims at the time of writing — underscoring both the scale of the operation and the threat actors’ continued reliance on public repositories as a distribution mechanism. Not ClickFix, Not a ZIP Drop: A Different Kind of GitHub Abuse GitHub-adjacent malware distribution has received a lot of CTI attention recently, but Operation RepoGhost doesn’t map cleanly onto either of the two patterns currently dominating that coverage. It isn’t a ClickFix campaign. Microsoft has documented phishing operations delivering RMM backdoors through fake Teams, Zoom, and Adobe Reader installers — but in that research, the infection starts with a phishing email that redirects victims to an attacker-controlled download page designed to resemble a legitimate software portal. The victim never actually lands on GitHub; they land on a spoofed imitation of it, then are talked into running a signed executable disguised as an app update. It’s a convincing lure, but it isn’t GitHub-hosted at all. It also isn’t the ZIP-and-extract pattern Trend Micro has documented. Trend Micro’s research into fake GitHub repositories distributing SmartLoader and Lumma Stealer describes campaigns that genuinely are hosted on GitHub — repositories disguised as gaming cheats, cracked software, and system tools, complete with inflated star counts and copied documentation. But in that pattern, the payload sits inside a ZIP archive alongside a stack of benign-looking files. The victim has to download the archive, extract it, and separately run an obfuscated script that’s distinct from whatever tool they thought they were getting. Operation RepoGhost skips both of those extra steps. There’s no phishing email, no spoofed portal, and no ZIP file to extract. The malicious code is embedded directly inside the same script the victim runs to use the fake tool or PoC exploit as advertised — meaning the infection happens as a straightforward byproduct of using the software exactly as intended, with no additional prompt, download, or action required beyond what the repository already asked for. The Lure — A Fake CVE-2026–41940 PoC Repository:-
• The initial infection chain begins with a fraudulent GitHub repository designed to closely resemble a legitimate CVE proof-of-concept. At first glance, it contains everything you’d expect from a real PoC: a script claiming to detect and exploit the targeted vulnerability, along with detailed documentation on how to use it.
• The repository had accumulated 313 stars and 39 forks — engagement numbers that do more than just look convincing. Repositories with higher star/fork counts are more likely to surface prominently in both GitHub’s own search and external search engines, effectively letting the threat actors use GitHub’s ecosystem as an SEO poisoning mechanism. A malicious repository with enough engagement can outrank legitimate results entirely.
• That’s exactly how we found it. While searching for a working PoC for CVE-2026–41940, the malicious repository appeared prominently in our search results.
• On closer inspection of the exploit code inside exp.py , we found it had no actual relationship to CVE-2026-41940 at all. Instead, the script contained functionality lifted from “claude-engineer,” an interactive coding agent built around Claude Opus 4.7 — likely repurposed as convincing filler to pad out the repository and make it look like a legitimate, functional tool.
• At the very start of the script, however, we found the real payload: a call to subprocess.Popen that executesscriptrunner.exe — a legitimate Microsoft App-V component — passingpowershell.exe through the-appvscript argument and configuring the process to run with a hidden window. This is a classic proxy-execution technique: rather than launching PowerShell directly, the threat actors abuse a trusted signed binary to do it on their behalf. The resulting PowerShell process retrieves a raw script hosted on Pastebin and executes it entirely in memory. - That Pastebin-hosted content is itself a PowerShell script responsible for fetching the next-stage payload. It downloads an executable named main.exe from172[.]237[.]119[.]163:8000 , writes it to the victim’s local TEMP directory, and executes it. Initial Infection Chain — Go-Based Infostealer Analysis:-
• The downloaded main.exe is a Go-based executable. Basic static analysis revealed its compilation metadata, including the-tags=shellcode build flag — instructing the Go compiler to include source files marked with theshellcode build tag during compilation. Function names recovered from the binary, includingloader.RunShellcode ,loader.runShellcodeThread , andloader.UnpackShellcode , confirmed the binary was built to handle and execute shellcode, likely as part of an in-memory execution or injection mechanism.
• Dynamic analysis confirmed this: the malware loads a malicious, obfuscated .NET assembly directly into memory, without ever writing it to disk, then establishes a connection to its command-and-control infrastructure at 194[.]102[.]104[.]141:22310.
• In our sample, the loaded .NET assembly identified itself as mid4 at runtime. We used the open-source ExtremeDumper utility to dump it from memory once loaded — the resulting assembly was approximately 168 KB.
• Inspecting the dumped assembly revealed extensive obfuscation across namespaces, method names, and strings. We attempted deobfuscation using the open-source .NET Reactor Slayer, but the tool didn’t recognize the specific obfuscation or packing scheme used, so only partial deobfuscation was possible — primarily recovering previously-obfuscated strings. Limited as it was, this gave us enough visibility to continue the analysis manually.
• One of the more interesting findings came from the assembly’s Main routine: a language-based execution check. The malware queries theMUILanguages property of theWin32_OperatingSystem WMI class and checks whether the returned values includeru-RU — the locale identifier for Russian. If the Russian locale is detected, the malware terminates immediately without executing any of its infostealer functionality. On any system that doesn’t reportru-RU , execution proceeds normally.
• The recovered strings also gave us direct insight into the malware’s capabilities. This infostealer is built to target browser-stored sessions and credentials, Discord tokens, Telegram sessions, Steam sessions, cryptocurrency wallets, and other sensitive data stored on the compromised system. We also identified hardcoded C2 configuration strings within the assembly, pointing to the same infrastructure observed during dynamic analysis — 194[.]102[.]104[.]141:22310 — further tying the in-memory .NET payload directly to the network infrastructure we’d already identified. One Repo, Two Payloads: Git History Exposes an Earlier NovaStealer Campaign:-
• Returning to the fake CVE-2026–41940 repository, we examined its commit history to understand how the payload had evolved over time. The repository’s earliest commits date to July 20, 2026, at which point the threat actors had already introduced a malicious one-liner payload — one that looked nothing like the Pastebin-based delivery mechanism used in the current stage of the campaign. Instead, this initial commit contained an exec statement followed by a large Base64-encoded blob, decoded and executed at runtime.
• Decoding that blob revealed a Python payload that branches its execution based on the victim’s platform:
• macOS (Darwin): decodes and executes a secondary Base64-encoded Python snippet, which downloads a binary named Peravi from217[.]156[.]122[.]146 and runs it. - Windows: follows a separate path, decoding and executing another Base64-encoded snippet that retrieves the custom Go-based infostealer from pypi3[.]cc — a distribution point distinct from the Pastebin-based delivery used in the current campaign iteration.
• Two later commits to the same repository — one on July 20 and one on July 30, 2026 — show the delivery mechanism evolving further, this time toward something closer to the version we analyzed in the current stage of the campaign. The July 20 commit swapped in PowerShell commands to retrieve the Go-based infostealer from a remote server at 85[.]120[.]255[.]252:8000 . Ten days later, the July 30 commit rotated that infrastructure to2[.]27[.]63[.]236:8000 .
• With this earlier NovaStealer distribution point in hand, we turned our attention to the sample itself. The original hosting server at 217[.]156[.]122[.]146 was no longer active by the time of our investigation, but we were able to obtain the exact sample through other threat intelligence sources. Static analysis immediately surfaced the stringmacos-stealer-v2-555549447c37d273301e3c5f9cf8d1155034eb89 , confirming it as a Nova macOS infostealer variant. According to prior research published by Insikt Group, the value555549447c37d273301e3c5f9cf8d1155034eb89 corresponds to the malware’s internal build identifier. 52 Repositories Deep — Mapping the Full Campaign Footprint:-
• Using the artifacts recovered from this single repository as pivot points, we leveraged GitHub’s built-in search alongside grep.app to identify additional repositories and map the broader infrastructure behind the campaign.
• In total, our investigation identified 52 malicious repositories connected to Operation RepoGhost. Analyzing their creation dates, commit histories, payloads, and infrastructure confirmed that the earliest identified activity dates back to November 2025 — evidence that the operation has remained active and continued evolving for several months.
• The repositories span a broad range of technical themes, all designed to look like legitimate tools:
• AI-related projects, including repositories impersonating Claude, KawaiGPT, OpenAI Sora2, KiteAI, and TokenTab.
• Cybersecurity-oriented tools, including fake React2Shell scanners, public CVE PoCs (like the one that started this investigation), HacXGPT, and OSINT utilities.
• Cryptocurrency-related software, including cryptocurrency tax calculators, a fake Polyseed Monero tool, and Antminer monitoring utilities.
• Analyzing the oldest identified iteration of the campaign — which we assess represents its earliest stage — showed CountLoader being distributed as the primary payload, using a delivery mechanism distinct from the ones observed later on. The original payload contained multiple hex-encoded strings decoded at runtime, ultimately executing an mshta -based payload hosted on CountLoader-associated staging infrastructure. - We observed the same execution flow in another of the 52 repositories, named apkprobe . Its hex-encoded strings decode to anmshta -based CountLoader payload hosted onpython3-library-node[.]com , delivering the infostealer to the victim. A complete list of CountLoader staging domains identified across the campaign is included in the IOC section below. Unmasking the Infrastructure: Tracing a Staging Domain and Building the Attribution Case:-
• While investigating pypi3[.]cc — the staging domain used to host the Go-based infostealer — we identified additional related infrastructure. Both domains sat behind Cloudflare, obscuring their true origin servers. - Digging further, we found that the same Cloudflare-fronted domain had previously been scanned by another researcher on URLScan, which had captured the site’s HTTP page title: “Build Panel.” Using that exact title as a pivot on URLQuery, we identified additional instances of the same interface — ultimately leading us to the underlying origin IP behind the staging infrastructure.
• The exposed server presented a login page, which we assess with moderate confidence to be a web-based management panel used by the threat actors to manage payloads hosted on their staging infrastructure. Building the Attribution Case
• Taken individually, none of the indicators we uncovered are enough to attribute this campaign on their own. Together, though, they point in a consistent direction:
• Deliberate exclusion of Russian-language systems — the Go-based infostealer explicitly checks for the ru-RU locale and refuses to execute if detected, a pattern consistent with threat actors avoiding compromise of victims in their own country or region. - Malware family lineage — both CountLoader and Nova macOS infostealer are malware families that have been extensively observed and documented within Russian-speaking cybercrime ecosystems.
• Based on the convergence of these findings, we assess with moderate to high confidence that Operation RepoGhost is operated by Russian-linked threat actors. Conclusion Operation RepoGhost is an ongoing malware distribution campaign that has evolved significantly since its earliest identified activity in November 2025. Across 52 malicious GitHub repositories, the threat actors have masqueraded as legitimate AI, cybersecurity, cryptocurrency, and vulnerability research projects to distribute malware to unsuspecting users. The campaign progressed from CountLoader targeting Windows systems, to the Nova macOS infostealer, and finally to a custom Go-based infostealer — all supported by a rotating network of staging servers, C2 infrastructure, and backend management tooling. Get Avyukt Security’s stories in your inbox Join Medium for free to get updates from this writer. Taken together, the malicious repository infrastructure, malware tradecraft, and reverse-engineering findings from this investigation tell a consistent story. Most notably, the Go-based infostealer’s deliberate exclusion of Russian-language systems, combined with its use of malware families widely observed within Russian-speaking cybercrime ecosystems, supports our assessment that the campaign is operated by Russian-linked threat actors. While no single indicator is sufficient for attribution on its own, the convergence of these findings gives us moderate to high confidence in this assessment. Ultimately, Operation RepoGhost demonstrates how effectively threat actors can abuse the trust built into public software repositories to distribute malware disguised as legitimate technical projects. Rather than relying on traditional phishing or ClickFix-style delivery, this campaign specifically targets users actively searching for software, security tools, and technical resources — making weaponized repositories an increasingly effective, and increasingly overlooked, malware distribution vector. Indicators of Compromise (IOCs):- Go-Based Windows infostealer Hashes :
• 215145A0513B8542F263C281AE2098939CCBFAAD0F1575BCF76B6A5592575377
• 622ACA0C672EC823D86832731FAFAC5F0A78F7D1E34D88B4B759A6EBD32FA1BF
• 0EC26FB54DFB3C3A56863C02F5CEEA78B32981643D862008E5A996CE508A11A1
• 2829ba8cf5fffbbd3abc2b5b15282a8e4d19502409731422416a5ba859cba7a3
• 20e596e6436f220401423ad21862e101e5d2afcfab3a55e5029a0aeafef93bc9
• 5aa9cdce0c1c5fe676f2b8deb8ed571b7cc15b66a079cd377cdf051bd6451b0e CountLoader Staging Domains:
• npm-storage.cc
• py-installer.cc
• node2-py-store.com
• node1-py-store.com
• python3-library-node.com
• s3-python.cc Go-Based InfoStealer Staging IPs/Domains:
• 2.27.63.236
• 85.120.255.252
• 185.177.239.149
• py-installer.com
• pypi3.cc
• 80.97.160.134 (Exposed backend panel for above two staging domains) Go-Based Infostealer C2 IP:
• 194.102.104.141 MacOS NovaStealer Staging IPs:
• 192.109.200.242
• 217.156.122.146
• 194.102.104.213
• 176.65.132.96 List of malicious GitHub repositories involved:
• https://github.com/bawadou/claude-engineer
• https://github.com/sequilade/tokentab
• https://github.com/anasu1/text-humanizer
• https://github.com/OStudi/short-video-generator-AI
• https://github.com/jacubes/CVE-2026-24061
• https://github.com/soverineg/cve-2026-41940-PoC
• https://github.com/tedt8ik31/web3-flashbots
• https://github.com/thomasdutraa07/Trading-Bot-for-Binance-Future
• https://github.com/qG5CAsz/walletool
• https://github.com/ultiwebtraffidt/openfi-bot
• https://github.com/ya-vocn-sveta/OF-Scraper
• https://github.com/ura-vf4/crypto-tax-calculator
• https://github.com/yadyvazifeh1oz92/ecdsa-private-key-recovery
• https://github.com/watsondonald14/mflowgen
• https://github.com/unknown-person00lie/KawaiiGPT
• https://github.com/tq17oa7/spyder-osint
• https://github.com/versiaever/Pharos-Testnet-Bot
• https://github.com/timuronlinq/messari-crack
• https://github.com/ternopil-te-te-t4p/cryptoquant-key-gen
• https://github.com/75al-ya/NaorisProtocol-bot
• https://github.com/tompftampffern/polyseed-monero
• https://github.com/tokmakova-nadyubya/sora2-watermark-remover-enchanted
• https://github.com/tsogatmap/pyasic
• https://github.com/tomateo1reg/sora2-watermark-remover-web-gui
• https://github.com/provified/Pharos-Testnet-Bot
• https://github.com/provified/KiteAI
• https://github.com/provified/NaorisProtocol-bot
• https://github.com/provified/openfi-bot/blob/main/bot.py
• https://github.com/lightsue/sora2-watermark-remover
• https://github.com/alptexans/RSC-Detect-CVE-2025-55182
• https://github.com/ghostofcor/Trading-Bot-for-Binance-Future
• https://github.com/tny1234/Trading-Bot-for-Binance-Future/blob/main/Logger.pyain/Logger.py
• https://github.com/vijay-shirhatti/RSC-Detect-CVE-2025-55182
• https://github.com/wi3memake/React2Shell-Scanner
• https://github.com/6rests/polyseed-monero/
• https://github.com/classicshi/sora-api
• https://github.com/tnbeznlacut/sora2-watermark-deleter-windows-macos
• https://github.com/s4larie/walletool/blob/main/walletool/
• https://github.com/taz4et/bitcoin-etl/blob/main/bitcoinetl/core.py
• https://github.com/barnew-st/ecdsa-private-key-recovery/blob/main/ecdsa_key_recovery/utils.py
• https://github.com/keineherz/pyasic/blob/main/pyasic/platform.py
• https://github.com/estrelar/antminer-monitor/blob/main/antminermonitor/system_check.py
• https://github.com/w1ndfly/KawaiiGPT/blob/main/utils/network.py
• https://github.com/ossessd/SoraWatermarkCleaner/blob/main/detection/signature.py
• https://github.com/wadingporque/apkprobe/blob/main/src/apkprobe/_compat.py
• https://github.com/murtapping/mir4-bot-draco-farming/blob/main/quest/quest_handle.py
• https://github.com/yo-steven/claude-engineer-exploration-20260613
• https://github.com/vmatveenkov/NaorisProtocol-bot/blob/e59ef8f85ceac796029635f9bddd0a6d8b6971dd/bot.py
• https://github.com/Metaldadisbad/HacxGPT/blob/e7c29b4f47bb6ca6b3139face2e0ce4f4b67486d/update.py
• https://github.com/uwctcjnwlk/web3-decoder/blob/6b052b337f0c85aa19b9ae97d08da90187ea66d0/libs/eth_decoder/bootstrap.py
• https://github.com/MorfNN/Portfolio/blob/a58dd0416f6538c1f3afc9a7a2ed99f147937313/projects/08-crypto-nft/crypto-tax-calculator/setup.py
• https://github.com/samy4samy/CVE-2025-59287-WSUS-2/blob/b02cf46ce639834e187495bfe9aa49f52e18cbc5/encypt.py

By Avyukt Security

Original Article