200+ GitHub Repos Caught Spreading Windows Malware in Coordinated Attack

Discover "Operation Muck and Load": a malware campaign using GitHub repositories to spread Windows threats via hidden payloads.

By Content Team

Jul 11, 2026

ON THIS PAGE

Security firm Socket has uncovered "Operation Muck and Load" — a campaign using 222 GitHub repositories across 190 accounts to distribute Windows malware. Active since January 24, 2026, the threat actor published over 1,200 package versions, 700 of which are malicious.

The attack disguises a Go module as a legitimate DNS scanning tool, impersonating the real open source project dnsub. Hidden PowerShell code then pulls encrypted payloads from dead-drop platforms including Pastebin, YouTube, Instagram, Telegram, and Google Docs — making it harder to shut down.

Final payloads include AsyncRAT, Quasar RAT, Vidar infostealer, and XMRig cryptominers. Anyone who has pulled a DNS or subdomain scanning module from GitHub should check what they actually installed — go.mod and go.sum are the place to start.

Source: SecurityWeek

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?