Nearly 300 Fake GitHub Repositories Distributing BoryptGrab Malware

Since late June 2026, nearly 300 fake GitHub repositories have been created, impersonating well-known software brands to distribute malware. The malware, a variant of BoryptGrab, targets Windows systems and is designed to steal credentials from various applications, including web browsers and cryptocurrency wallets. The attack employs social engineering tactics, with victims misled into downloading a ZIP file containing the malware. Security researchers from Arctic Wolf discovered the campaign after identifying a fake repository posing as their own brand. Most of the malicious repositories have been removed by GitHub, but some may still be active, posing ongoing risks. The attack highlights the dangers of brandjacking and the effectiveness of social engineering in cybersecurity threats.

Key Points: • Nearly 300 fake GitHub repositories have been identified, spreading malware. • The malware, BoryptGrab, targets credentials from web browsers and crypto wallets. • Most malicious repositories have been removed, but some may still be operational.