Operation RepoGhost: Russian-Linked Malware Hiding in GitHub Repositories
GitHub has been turned into a shop window for malware, and the victim need neither open a suspicious archive nor visit a counterfeit website. Researchers at Avyukt Security have uncovered Operation RepoGhost, in which attackers fashioned dozens of plausible repositories offering tools for AI, cybersecurity, cryptocurrency, and vulnerability research. Merely running the downloaded project simultaneously triggered a concealed infection chain.
The investigation began with a search for a working exploit for CVE-2026-41940. Among the results was a GitHub repository that appeared to be a fully fledged proof-of-concept, complete with detailed documentation, and it had managed to amass 313 stars and 39 forks. The exploit itself bore no relation to the vulnerability. The researchers traced most of the code to an unrelated project, claude-engineer, likely added to lend an air of authenticity.
A Multi-Stage Chain Hidden in a Python Script
The genuine payload lurked at the very start of the Python script. The code launched the legitimate Microsoft App-V component scriptrunner.exe, quietly opened PowerShell through it, and fetched the next script from Pastebin. A Go executable then landed on the machine, loading an obfuscated .NET assembly straight into memory and connecting to a command-and-control server.
The final malware operated as an infostealer. It hunted for saved browser sessions and credentials, Discord tokens, active Telegram and Steam sessions, and cryptocurrency wallet data. Before pilfering any information, however, the program inspected the Windows language. Upon detecting the ru-RU locale, execution ceased at once.
Commit History Reveals an Evolving Arsenal
The GitHub commit history revealed that the infrastructure shifted in step with the malware. The earliest activity dates to November 2025, when the operators distributed CountLoader on Windows. In January 2026, repositories bearing NovaStealer for macOS emerged, and by June the criminals had concentrated on their own Windows data-stealer, written in Go.
Through shared code fragments, commit histories, and infrastructure, the researchers linked 52 repositories to RepoGhost. Among the lures were counterfeit Claude and Sora projects, OSINT tools, React2Shell scanners, cryptocurrency utilities, trading bots, and bogus PoCs for well-known vulnerabilities.
Attribution: Russian-Linked Operators
Avyukt Security attributes the campaign to Russian-speaking hackers with moderate to high confidence. As the researchers detail in their analysis, they rely chiefly on the malware’s deliberate refusal to run on Russian-language Windows and on the use of the CountLoader and NovaStealer families, previously seen in Russian-speaking criminal circles. The authors stress, nonetheless, that no single indicator alone can establish the operators’ origin.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
