Operation Muck and Load: 222 GitHub Repos Push Windows Malware via Fake Go Module

Why it matters

Open-source package repositories are a trusted first step in nearly every software build. Operation Muck and Load shows a threat actor manufacturing credibility at scale: 222 GitHub repositories across 190 accounts, kept active through automated commit-farming, all pointing developers at a single malicious Go module. A single go get of a “DNS scanner” can hand an attacker a persistent foothold on a Windows developer workstation — and from there, the rest of the build pipeline.

What happened

Supply-chain security firm Socket tracked the campaign as Operation Muck and Load. It starts with a malicious Go module, github.com/kaleidora/dnsub-scanning-tool, published to look like the legitimate dnsub subdomain-scanning project. Since January 24, 2026, the actor has pushed more than 1,200 versions of the package — roughly 700 of them malicious — with GitHub Actions workflows generating timestamp commits that surface as plausible Go pseudo-versions.

Most of the 222 repositories act as lures to make the project look legitimate and recently maintained. Some also carried malware directly, either embedded in the source tree or shipped as GitHub release assets. Socket identified at least 14 unique confirmed malware files across the actor’s workflow repositories.

Technical details

The malicious module’s main() function launches a hidden PowerShell command before any scanning logic, using excessive whitespace to obscure it. That PowerShell downloads content from public dead drops, decodes it with certutil, writes it as L.ps1, and runs it with execution-policy bypass in a hidden window. The script then fetches encrypted resolver material from mirrored public platforms — Pastebin, Rlim, YouTube, Instagram, Telegram, Google Docs, GitCode, and Muck-themed hosts such as muckcoding.com — decrypts a URL, retrieves a password-protected archive, extracts it, and executes the payload.

Final-stage payloads include AsyncRAT, Quasar RAT, a Remcos-style RAT, the Vidar infostealer, and XMRig/BitMiner Monero cryptominers. Socket linked the activity to the shared actor email ischhfd83@rambler.ru and Muck-themed infrastructure from earlier operations, and reported the GitHub infrastructure to GitHub’s security team.

Defender actions

• Treat any import of github.com/kaleidora/dnsub-scanning-tool as malicious and block it; alert on developer machines that pulled it.
• Add muckcoding.com and the associated dead-drop patterns to web/DNS blocking and EDR detections.
• Scan Go dependencies for PowerShell execution or certutil decoding inside pre-scan logic, and watch for commit-farmed pseudo-versions with timestamp-heavy history.
• Monitor endpoints for the listed RAT/infostealer/cryptominer families and review build pipelines for unexpected outbound archive fetches.
• Report suspicious GitHub repositories impersonating legitimate tooling to GitHub’s security team.