Fake Go scanning tool hides malware across 222 GitHub repositories

Researchers at Socket uncovered a network of 222 GitHub repositories, tracked as Operation Muck and Load, built to spread Windows malware through a fake Go module posing as a DNS and subdomain scanner. Running the module quietly launches PowerShell that pulls an encrypted payload from attacker infrastructure and deploys infostealers, remote access trojans, and cryptominers. To look trustworthy, the operators used an automated workflow that force-pushes fake commits every minute, making repositories appear actively maintained and generating hundreds of package versions. More than 700 of the module's 1,200-plus versions were malicious. The lures cluster around crypto wallets, Telegram bots, and game cheats, aimed at people likely to run untrusted code.

Check

Review whether developers pulled Go modules or ran tools from unfamiliar GitHub repositories, particularly crypto, wallet, or game-cheat-themed ones, and watch for hidden PowerShell launching from a supposed utility on developer machines.

Affected

Developers and users who clone, build, or run code from these lure repositories; a module posing as a legitimate scanner instead installs infostealers, remote access trojans, or cryptominers on their Windows machines.

Fix

Verify a repository's authenticity beyond how active it looks, since fake commit activity can be manufactured, prefer official module sources, inspect code before running it, and use isolated environments for untrusted tools.