Over 2,000 Windows PCs Hacked via GitHub: Trojan.Loader.3261 and the Trap Aimed at Security Professionals Themselves

On 5 November 2026, security vendor Doctor Web published its analysis of a GitHub supply-chain campaign that has compromised more than 2,000 Windows computers. The irony: the victims are cybersecurity professionals — the very people paid to stop exactly this kind of attack. The malware is disguised as familiar open-source projects, and all it takes is a clone and a click on Build — in some cases, merely opening the project in Visual Studio is enough for the machine to be taken over.

Quick answers

• Trojan.Loader.3261 is Doctor Web's name for the malware loader in a campaign distributed through fake GitHub repositories, published on 5 November 2026; more than 2,000 Windows machines have been compromised, with security professionals as the primary targets.
• Three trigger mechanisms: (1) a PowerShell command planted in the Pre-build Event of a Visual Studio project file (.csproj), executed the moment the victim hits Build; (2) a malicious .suo file hidden in the .vs folder, triggered as soon as the solution is opened — no compilation needed; (3) malicious code in Python/Go files pushed out of view behind long runs of whitespace characters.
• The main payload is Microsoft.exe (an Electron app, detected version 1.4.5, delivered inside an archive named Quixo.7z): it disables Windows Defender, UAC, security warnings, System Restore and VSS; adds RegAsm.exe and dwm.exe to Defender's exclusion list; attempts to uninstall McAfee, ESET and Malwarebytes; and edits the hosts file to block antivirus vendors' websites.
• The installed toolkit includes: two copies of AsyncRAT (a remote access trojan) differing only by port, a clipboard stealer that swaps cryptocurrency wallet addresses, and an infostealer harvesting browser passwords, FTP credentials from FileZilla and Total Commander, SSH sessions from MobaXterm.ini, VPN configurations and Discord tokens — all exfiltrated through a Telegram Bot.
• Many malicious repositories were still online when the original post checked: of the 9 example repositories named, only 2 returned a 404 error. Doctor Web has published indicators of compromise (domains, IPs and file hashes) in its malware-iocs repository.

What is Trojan.Loader.3261?

Trojan.Loader.3261 is the name security vendor Doctor Web gave to the loader in a software supply-chain campaign run through GitHub, analyzed in a report published on 5 November 2026. Instead of spreading through phishing email or malicious websites, the attackers post fake open-source projects on GitHub — disguised as network scanners, reverse proxies, log-processing scripts and other security utilities. These malicious repositories have been appearing for about two years, and according to the original post, some had still not been taken down at the time of checking.

What makes the campaign dangerous is that it does not exploit victims' ignorance. It exploits the habits and confidence of security practitioners: you need a tool, you search GitHub, you find a repository that looks trustworthy, you git clone it and build it yourself — and that seemingly harmless build step is exactly what lets the malware in.

How is the malware triggered?

Doctor Web found the malware planted in three different kinds of project files, each with its own trigger mechanism:

Mechanism	How it works	When it fires
Pre-build Event in a .csproj file	Abuses the feature that lets a project run commands before compilation starts; the fake project runs a PowerShell command instead of benign tasks like copying files or stamping a version	The moment the developer clicks Build
.suo file in the .vs folder	The .suo file stores Visual Studio settings and lives in the hidden .vs folder most developers never inspect; a crafted .suo can trigger code execution (a technique pointed out by Sangfor researcher Zhiniang Peng back in October 2023)	As soon as the solution is opened in Visual Studio, before any build
Whitespace in Python/Go code	The malicious code is pushed far to the right behind a long run of spaces or tabs; anyone reading the file sees an apparently empty, harmless line while the real code sits off-screen	When the tool is run or built as usual

Regarding the .suo case, the original post notes that Microsoft does not classify this as a security vulnerability in the usual sense: the company considers opening projects from untrusted sources inherently risky and recommends enabling Visual Studio's trust settings. Whatever the classification, the practical effect is unchanged: in some cases, simply opening a project is enough to get infected.

What does the malware do once it fires?

When one of the three mechanisms triggers, a PowerShell script connects to the attackers' server and retrieves an encoded payload download URL. To blend into normal corporate traffic, the campaign also abuses familiar platforms — YouTube, Telegram, Google Docs, GitCode and Pastebin — to store or distribute its data. The downloaded payload is an archive named Quixo.7z, containing a folder disguised as a Windows graphics component and the file Microsoft.exe — the component that performs most of the damage, built with Electron (the framework behind many popular desktop apps), detected at version 1.4.5.

Immediately after launch, Microsoft.exe disables Windows Defender, User Account Control (UAC), Windows security warnings, System Restore and the Volume Shadow Copy Service (VSS) — the service behind backup and recovery. It adds RegAsm.exe and dwm.exe to Defender's exclusion list so payloads hidden inside those processes are never scanned, attempts to uninstall McAfee, ESET and Malwarebytes, and edits the hosts file to block the machine from reaching antivirus vendors' websites. In other words, it does not just switch off the defenses — it also tries to stop the victim from downloading new protection.

Its detection-evasion layer is equally thorough: parent-process spoofing so it appears to have been launched by explorer.exe; a registry edit to bypass Smart App Control; reading a clean copy of ntdll.dll straight from disk to restore code that security software has hooked for monitoring; the Halo's Gate technique to call system functions directly; and disabling both ETW and AMSI — two Windows mechanisms for tracking suspicious behavior. The final payload is injected into trustworthy-looking Windows processes such as RegAsm.exe and dwm.exe.

Which malware gets installed, and what data is stolen?

Trojan.Loader.3261 does not install just one piece of malware:

• Two copies of AsyncRAT: a remote access trojan, nearly identical, differing only in the network port used. Researchers assess that this arrangement could let two operators control the same machine through two separate ports — an inference from the structure, not a verified conclusion.
• A clipboard stealer: it watches the clipboard; when the user copies a cryptocurrency wallet address, it swaps in the attackers' address. Each swap triggers a screenshot sent to a Telegram Bot together with the active window title, the username and the machine's IP address.
• An infostealer: it first checks whether the machine is running in a sandbox or virtual machine; only if it is not an analysis environment does it start collecting. The target list is tailored precisely to how security professionals work: saved browser data and passwords; FTP logins stored in FileZilla and Total Commander; the MobaXterm.ini file containing saved SSH sessions; VPN configurations; messaging app data; game accounts; and Discord tokens. Everything is packaged and sent out through a Telegram Bot.

This is the scariest part: a security professional's laptop typically holds access to the systems, servers and internal networks of many organizations. Compromising one such machine can hand the attackers the keys to many other systems.

The campaign started with gamers, then moved up to security professionals

According to Doctor Web, the campaign did not begin by targeting security experts. In its early phase, the fake repositories were mostly advertised as bots and cheating tools for cryptocurrency games — including the game Catizen on Telegram — aimed at users hoping to earn tokens or gain an in-game advantage. Some repositories even included step-by-step instructions for installing Visual Studio and downloading the source, so that inexperienced users could do it themselves. The operators later pivoted to higher-value targets, disguising the malware as network scanners, security-testing tools and log-analysis scripts. One named example is a "lightweight" script for parsing and cleaning output from Fscan — a network scanner with nearly 15,000 stars on GitHub; another repository copied a legitimate open-source tool's description verbatim, making it very hard to spot from a quick read.

Researchers also found an unfinished component designed to install the loader as a Windows Service and re-download it if deleted — a sign the campaign is still under development. Of the 9 repositories given as examples, two had returned 404 errors; the rest were still active at the time of the check mentioned in the post.

Is this campaign related to Water Curse and GitVenom?

Doctor Web was not the first to encounter this kind of toolkit. In June 2025, Trend Micro published research on the Water Curse campaign, in which at least 76 GitHub accounts were used to distribute fake penetration-testing tools. The two campaigns overlap in striking ways: both use the Pre-build Event in .csproj files; both use an Electron application; both deploy a Scheduled Task to relaunch Microsoft.exe; both hide code inside RegAsm.exe; both use Telegram to move stolen data out; and even some internal module names match — boot_f, kernel_f and thread_f. Trend Micro had spotted these components in 2025 without fully determining their function; Doctor Web's analysis went deeper.

However, the original post stresses that overlap in code and technique is not enough to conclude the two campaigns are run by the same group — in cybersecurity, tooling can be shared, bought, sold or copied between groups, and attribution is inherently difficult. Earlier still, in February 2025, Kaspersky published the GitVenom campaign: hundreds of fake GitHub projects using a similar trick (Python code hidden after roughly 2,000 tab characters), with one attacker wallet receiving about 5 BTC — worth nearly 485,000 USD at the time. And in January 2021, Google's Threat Analysis Group described a campaign Google attributed to a North Korean government-backed group that approached security researchers with offers to collaborate, then sent them a Visual Studio project containing a malicious DLL set to run through build events. The original post states clearly that there is currently no evidence linking the 2021 campaign to the repositories Doctor Web has analyzed.

How can you protect yourself when using code from GitHub?

The campaign's biggest lesson: publicly available source code on GitHub is not automatically safe. Before opening a freshly cloned project, check these four points — the recommendations compiled by the original post:

1. Inspect the .csproj file: open it in a plain text editor and look for unusual Pre-build Event entries — for example a <Target Name="PreBuild" ...> element containing an <Exec Command="powershell -enc ..."/>. A tool you just downloaded that runs PowerShell before compiling is a major red flag; older projects may use the <PreBuildEvent> tag directly.
2. Delete the .vs folder before opening a solution: this hidden folder can contain a booby-trapped .suo file.
3. Review the full Python and Go source: do not just read what is normally visible — check for code pushed far away with long runs of spaces or tabs (show invisible characters, scroll all the way across, or look for abnormally long lines).
4. Build projects inside a virtual machine: never experiment with repositories of unclear origin on the laptop that stores your passwords, SSH keys, VPN details or work accounts; use a dedicated VM with a clean snapshot you can roll back to.

In addition, Doctor Web has published a list of IOCs — domains, IP addresses and file hashes — in its malware-iocs repository, so defense teams can check them against their own systems.

Frequently asked questions

What is Trojan.Loader.3261, and who discovered it?

Trojan.Loader.3261 is the name security vendor Doctor Web gave to the loader in a campaign spread through fake GitHub repositories, published in its analysis on 5 November 2026. The campaign has compromised more than 2,000 Windows machines; the malware is disguised as open-source tools such as network scanners and log-analysis scripts, primarily targeting cybersecurity professionals.

Can you really get infected just by opening a Visual Studio project?

Yes, you can. According to the analysis, besides the Pre-build Event mechanism in .csproj files (which fires on Build), the attackers also hide commands in the .suo file inside the hidden .vs folder — a crafted .suo file can trigger code execution the moment a solution is opened, with nothing compiled at all. That is why the practical advice is to delete the .vs folder before opening an unfamiliar solution, and to test-build inside a virtual machine.

What data does the malware steal?

Per Doctor Web, the payload set includes two copies of AsyncRAT for remote control, a component that swaps cryptocurrency wallet addresses in the clipboard (with screenshots sent to a Telegram Bot), and an infostealer harvesting browser passwords, FTP credentials in FileZilla and Total Commander, the MobaXterm.ini file with saved SSH sessions, VPN configurations, messaging app data, game accounts and Discord tokens. The greatest concern is that such access details can lead onward into many other organizations' systems.

Is this campaign the same as Trend Micro's Water Curse?

That cannot be concluded yet. Water Curse (Trend Micro, June 2025, at least 76 GitHub accounts distributing fake pentesting tools) matches this campaign on many techniques: Pre-build Events in .csproj, an Electron app, a Scheduled Task relaunching Microsoft.exe, code hidden in RegAsm.exe, Telegram exfiltration, and even the internal module names boot_f/kernel_f/thread_f. But technical overlap is not proof of a single actor, because attack tooling can be shared, traded or copied.

Have all the malicious repositories been taken down?

No — according to the original post, of the 9 repositories Doctor Web named as examples, only 2 returned a 404 error; the rest were still online at the time of checking. That is why users cannot rely entirely on platform takedowns: inspecting .csproj files, the .vs folder and the source before building — and building unfamiliar code inside a VM — remain the most important defenses. Doctor Web has published IOCs (domains, IPs, hashes) in its malware-iocs repository for the community to check against.

Conclusion

A useful-looking repository, one git clone, one click on Build — that is all it takes for the computer of someone who hunts malware to become a tool serving the malware's distributors. Trojan.Loader.3261 stands out not because its techniques are brand new, but because it strikes the blind spot of the most skilled users: their familiar workflow with open-source code. In an environment where security professionals routinely store SSH keys, VPN credentials, tokens and system access, the fallout from one careless build can reach far beyond a single personal machine. Inspect before you build, and build unfamiliar code in a virtual machine — the two cheapest habits are also the two that save the most.

Source: post by the Facebook page Học lập trình cho người mới bắt đầu (9 November 2026), compiled from Doctor Web's analysis of Trojan.Loader.3261 (published 5 November 2026) and related research by Trend Micro (Water Curse), Kaspersky (GitVenom) and the Google Threat Analysis Group; edited and structured by Wotech Electronics. Illustrations: photos attached to the original post.