- The Mess: Researchers uncovered Operation RepoGhost, a Russian-linked malware campaign hiding inside 52 fake GitHub repositories. The repositories impersonated AI tools, cybersecurity utilities, Web3 projects, cryptography software and vulnerability PoCs.
The campaign has been active since at least November 2025.
The trick is brutally simple.
Build something that looks useful to developers.
Put it on GitHub.
Add believable documentation.
Make the repository look active.
Then wait for someone to copy the commands from the README and run them.
No phishing email is required.
No suspicious download portal is required.
No ZIP attachment needs to survive an antivirus scan.
The developer goes to GitHub because they are looking for code.
The code is the trap.
One of the most convincing examples was a fake proof-of-concept for CVE-2026-41940, a critical cPanel and WHM authentication bypass. The repository reportedly accumulated 313 stars and 39 forks, giving it exactly the kind of social proof that makes developers lower their guard.
- The Damage: Running the fake PoC can execute a PowerShell stager that retrieves the actual malware, ultimately deploying a Go-based infostealer capable of stealing browser sessions, Discord tokens, Telegram and Steam sessions and cryptocurrency wallet data.
The campaign is more interesting than a collection of random malicious repositories.
Researchers traced common code, commit histories and infrastructure across the repositories and connected them into a larger operation.
The attackers changed disguises.
The infrastructure evolved.
The payloads changed.
The GitHub accounts changed.
The basic business model did not.
Find something developers desperately want.
Then become the thing they are searching for.
That includes fake AI utilities, security tools, cryptocurrency software and vulnerability research projects.
The CVE angle is particularly nasty.
Security researchers routinely search GitHub for PoCs when validating vulnerabilities. A repository carrying the correct CVE number, technical explanation and working-looking code immediately gets a credibility boost.
RepoGhost abuses exactly that habit.
A developer searching for an exploit may think they have found the technical reference they need.
Instead, they have found the malware delivery mechanism.
The PoC Was the Malware Loader
The fake CVE-2026-41940 repository reportedly contained unrelated AI-agent code mixed with the malicious components. That made the project look less like a purpose-built malware drop and more like a legitimate technical repository.
The malicious chain used PowerShell to retrieve the next stage from Pastebin.
That stage eventually delivered a custom Go-based infostealer.
Researchers say the malware loads an obfuscated .NET assembly directly into memory.
That matters.
The victim isn’t necessarily downloading an obvious executable called stealer.exe.
The malicious repository can instead instruct the developer to execute a command that starts the chain.
The developer thinks:
“I am testing the exploit.”
The attacker knows:
“You are installing my infostealer.”
It Wasn’t One Repository
The investigation started with one suspicious repository.
Then the researchers followed the breadcrumbs.
The result was a network of 52 repositories.
They covered multiple developer interests:
- AI and AI-agent tooling
- cybersecurity utilities
- vulnerability research
- Web3
- cryptocurrency
- cryptography
- technical development tools
That diversity is intentional.
Attackers don’t need every developer.
They need enough believable repositories to appear wherever developers search.
The campaign also appears to have evolved through several malware generations, with researchers linking the infrastructure and code to earlier CountLoader activity and the Nova macOS infostealer before the operation moved toward its current Go-based payloads.
The Malware Even Knows Where It Is
One of the more interesting clues was found inside the malware itself.
Researchers identified a language-based check that causes the malware to terminate on Russian-language systems.
That is not proof of Russian government involvement.
It is, however, one of the indicators researchers used when assessing the campaign’s Russian links.
The attackers also exposed infrastructure associated with a Cloudflare-fronted “Build Panel”, apparently used to manage payload generation or distribution.
This looks less like someone uploading one infected PoC on a Friday night and more like an operation designed to manufacture believable technical content at scale.
GitHub Trust Is the Attack Surface
This is where RepoGhost gets uncomfortable.
GitHub itself does not need to be compromised.
The attackers only need developers to trust what they find there.
That distinction matters.
The supply-chain attack doesn’t require modifying Microsoft, GitHub or a major open-source project.
It can happen below that level.
A developer searches for a PoC.
Finds a repository.
Sees stars.
Reads a README.
Copies a command.
Runs it.
Game over.
The repository was never the product.
The repository was the lure.
Security Researchers Are Targets Too
This campaign is particularly relevant to security teams.
Researchers regularly download PoCs, exploit demonstrations and proof-of-concept tooling.
That creates a strange inversion.
The people trying to reproduce vulnerabilities are often expected to execute code specifically designed to exploit vulnerabilities.
A malicious actor only needs to make their fake PoC look credible.
That means security labs should treat public exploit repositories as hostile software, not trusted research material.
Disposable virtual machines.
No production credentials.
No browser sessions.
No cryptocurrency wallets.
No SSH keys.
No access to internal networks.
And certainly no reason for a PoC downloaded from an unknown GitHub account to have unrestricted access to a developer workstation.
- The Fix: Treat every third-party GitHub PoC as untrusted code, verify the repository and author independently, inspect the commands before execution, and run suspicious exploit tooling inside an isolated environment with no access to production credentials.
If a repository asks you to execute PowerShell, Python, Bash or another interpreter, stop treating the README as documentation.
It is code.
The command is part of the attack surface.
Bugstoday Opinion
GitHub has become the world’s technical vending machine.
Need a scanner?
There is a repository.
Need an exploit PoC?
There is a repository.
Need an AI agent?
There are probably 400.
That convenience creates one enormous problem.
Nobody has to hack the vending machine if they can put poisoned products inside it.
RepoGhost understands that perfectly.
The attackers didn’t need to compromise GitHub’s infrastructure.
They only needed developers to believe that a repository with 313 stars looked legitimate.
That’s a cheap attack.
And cheap attacks scale beautifully.
Bugstoday verdict: the next time a GitHub README tells you to run a command as root or administrator, don’t ask whether the CVE is real. Ask whether the repository is.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Avyukt Security — Operation RepoGhost research
InfoSec Write-ups — Operation RepoGhost technical analysis
CVE — CVE-2026-41940
GitHub Advisory Database — CVE-2026-41940
MITRE ATT&CK — Command and Scripting Interpreter / PowerShell
