BoryptGrab Malware — Analysis, Campaigns & Threat Activity

Related Threat Clusters

• BoryptGrab Stealer Malware Campaign Targets Windows Users via Fake GitHub Repositories

  Trend Micro has reported a new malware campaign involving BoryptGrab, a stealer that targets Windows users through deceptive GitHub pages. This malware collects sensitive data, including browser and cryptocurrency…

  10 articles · Updated March 6, 2026
• Nearly 300 Fake GitHub Repositories Distributing BoryptGrab Malware

  Since late June 2026, nearly 300 fake GitHub repositories have been created, impersonating well-known software brands to distribute malware. The malware, a variant of BoryptGrab, targets Windows systems and is designed…

  2 articles · Updated July 16, 2026
• Artlist Subdomain Compromised in ClickFix Campaign Using EtherHiding Technique

  In July 2026, a ClickFix campaign was discovered on the Artlist subdomain new-blog.artlist[.]io, where attackers injected malicious code that masqueraded as a CAPTCHA to install a Remote Access Trojan (RAT). The attack…

  33 articles · Updated July 14, 2026

Recent Intelligence Reports

• Nearly 300 New Fake GitHub Repositories Spread Malware — www.clubic.com · July 17, 2026
• Fake-GitHub-Repositories: Infostealer Instead of Security or Developer-Tools — www.heise.de · July 17, 2026
• Fake GitHub Repositories: Infostealer Instead of Security or Developer Tools — Heise.De · July 15, 2026
• Nearly 300 GitHub repos pose as legit software to push malware — Bleepingcomputer · July 14, 2026
• Stealer malware distributed via bogus GitHub tools | brief — Scworld · March 7, 2026
• BoryptGrab Stealer — Broadcom · March 6, 2026

Related Entities