The BoryptGrab campaign, reported by Trend Micro, relies on fraudulent GitHub repositories optimized for search engines and deceptive download pages to distribute a data-stealing malware family targeting Windows users. The malware deployment chain ultimately delivers multiple payloads, including a reverse SSH backdoor. Evidence from repository commit histories suggests the activity dates back to at least April 2025, while malicious ZIP samples began appearing toward the end of 2025. This timeline indicates a sustained and evolving operation rather than a short-lived campaign. Indicators such as Russian-language comments in the code, log entries, and infrastructure artifacts suggest a potential Russian origin, although Trend Micro refrained from making a definitive attribution.
Initial Access & SEO Poisoning
The attackers created more than one hundred public GitHub repositories designed to appear as legitimate download pages for popular software tools. These repositories impersonate applications such as game cheats, cracked software, and productivity tools. Each repository contains README files filled with carefully selected SEO keywords, allowing them to rank prominently in search engine results and appear alongside legitimate software listings.
In one documented case, a repository impersonating Voicemod Pro appeared directly beneath the legitimate result in Google Search results. Users following the link were guided through a deceptive download sequence that ultimately delivered a malicious ZIP archive. Other software brands impersonated in the campaign include VMware, Krita, Filmora, and Voicemod, among others.
Infection Chain & Execution Paths
The infection process begins when a user downloads a ZIP archive from one of the fake GitHub pages. The repository contains an index.htm file with Russian-language comments that silently redirects visitors to a home.html page. This page decodes a hard-coded Base64 URL and forwards the victim to a final fake download site where the malicious ZIP file is dynamically generated and served.
Once extracted, several execution paths may be triggered:
- In a common variant, a legitimate-looking executable performs DLL side-loading, loading a malicious libcurl.dll. This DLL decrypts an embedded launcher payload using XOR and AES-CBC operations, then connects to attacker infrastructure to retrieve the BoryptGrab stealer.
- Another pathway involves a VBS downloader that conceals commands within integer arrays. The script reconstructs and executes PowerShell commands, retrieves a launcher from a remote server, and may add Microsoft Defender exclusions to reduce the likelihood of detection.
- The launcher component downloads the BoryptGrab stealer and may also retrieve additional payloads such as Vidar variants, the TunnesshClient PyInstaller backdoor, and a Golang downloader known as HeaconLoad. Launchers request specific payload builds using identifiers such as Shrek, Leon, or CryptoByte, and they create scheduled tasks to maintain persistence.
In many observed cases, the launcher communicates with attacker servers on port 5466, passing the build identifier through a “-b” argument that allows operators to track different infection branches.
BoryptGrab Stealer: Technical Capabilities
BoryptGrab is a C/C++-based information stealer capable of receiving command-line arguments such as –output-path, which determines where stolen data is stored, and –build-name, which labels collected data for campaign tracking. If operators do not specify a build name, the malware defaults to internal identifiers such as CryptoByte, Shrek, Sonic, or Yaropolk.
Before initiating data theft, the malware performs virtual machine detection by querying registry entries and searching for files associated with virtualization environments. It also compares running process names against a predefined list and attempts to execute with elevated privileges when possible.
According to Trend Micro’s analysis, BoryptGrab extracts data from nine web browsers, including Google Chrome, Microsoft Edge, Mozilla Firefox, Opera, Vivaldi, Brave, Chromium, CentBrowser, and Yandex Browser. The malware incorporates code from public GitHub projects designed to bypass Chrome App-Bound Encryption, a security mechanism introduced by Google in 2024 to make cookie theft more difficult on Windows systems.
The stealer also targets a wide range of cryptocurrency wallets, including Exodus, Electrum, Ledger, Trezor, Atomic, Binance, Wasabi, Bitcoin Core, Ethereum wallets, and others spanning both desktop applications and browser extensions.
Beyond browser and wallet data, BoryptGrab deploys a FileGrabber module to collect files with specific extensions from common directories. It extracts Telegram data, and newer builds also capture Discord authentication tokens, enabling potential account takeover operations. All harvested information is compressed before being transmitted to the attacker’s infrastructure.
TunnesshClient Backdoor
TunnesshClient is a backdoor packaged with PyInstaller that creates a reverse SSH tunnel connecting the victim system to attacker-controlled servers. The malware first retrieves a challenge and credential set through HTTP requests, derives SSH keys, and then establishes remote port forwarding. This tunnel allows attackers to execute commands, enumerate and exfiltrate files, upload data, or route traffic through the compromised system as a SOCKS5 proxy.
In another variant, the malware launches a local SSH server on the infected system and forwards authentication credentials back to the operator, enabling attackers to pivot traffic through the compromised host.
Defender Recommendations
From a defensive perspective, the combination of SEO-poisoned GitHub repositories, layered downloader chains, multiple information stealers, and SSH-based backdoors highlights the risks associated with downloading unofficial or “free” software tools.
Organizations should treat unofficial development utilities and cheat tools as high-risk downloads, enforce application control policies, and monitor outbound HTTP and SSH traffic for unusual patterns. Security teams should also investigate indicators such as unexpected scheduled tasks, sudden Windows Defender exclusion changes, and outbound connections to unfamiliar infrastructure.