{
  "name": "GitHub Impersonation Deploys Information Stealer",
  "slug": "github-impersonation-deploys-information-stealer",
  "description": "An internal security operations team identified a fraudulent GitHub page impersonating a cybersecurity vendor to target customers and the general public. The malicious page appeared legitimate by referencing authentic services and operational requirements. While the GitHub page itself contained non-malicious content, a disguised link led victims to download a ZIP archive containing malicious executables. The attack chain deployed BoryptGrab Stealer information-stealing malware through DLL side-loading techniques. Investigation revealed nearly 300 similar repositories impersonating well-known organizations including Malwarebytes, Bitdefender, and 360 Total Security, using SEO keywords to attract victims. The malicious page has been removed and detection capabilities have been enhanced.",
  "published": "2026-07-02T16:15:21.729000+00:00",
  "created_at": "2026-07-03T07:23:44.946000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-07-03T07:23:44.946000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "boryptgrab",
    "boryptgrab stealer",
    "dll side-loading",
    "fake repositories",
    "github impersonation",
    "information stealer",
    "seo poisoning",
    "social engineering"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "7a8e7190-e2ac-4090-84a3-221298e8c0f5",
        "name": "https://github.com/antivirus-free-bitdefender"
      },
      {
        "id": "34818069-1a88-4db6-902b-643dacf1639a",
        "name": "https://bentleyvazquezpvey.github.io/.github/"
      },
      {
        "id": "4e007065-87f9-46cb-991e-013ced9c65b2",
        "name": "https://github.com/Arctic-Wolf-Security"
      },
      {
        "id": "aa5caf32-f795-4d29-a703-3fd2ebbba44d",
        "name": "https://github.com/malwarebytes-protection"
      }
    ],
    "attack_patterns": [
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "cf746a02-00ea-419e-912d-7b03f969c491",
        "name": "T1518.001"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "667462db-9031-48eb-893a-05d35f9330a7",
        "name": "T1056.001"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "29398669-98ed-4766-9dac-f9632f7175ff",
        "name": "T1518"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "b7c6c1ad-f183-4128-8427-3891029c73dc",
        "name": "T1539"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "fe6f2946-a01e-460c-9636-8c48b45dd0e6",
        "name": "T1189"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "malware": [
      {
        "id": "191dee7a-e5f6-4dc6-afe9-ad968a7c263e",
        "name": "BoryptGrab Stealer",
        "slug": "boryptgrab-stealer"
      }
    ],
    "observables": [
      {
        "id": "0632b9fb-98e1-4a6d-a047-07fecdc6de3c",
        "name": "https://github.com/antivirus-free-bitdefender"
      },
      {
        "id": "c1590759-4005-4a01-b1fa-cc5d1e6f591e",
        "name": "https://bentleyvazquezpvey.github.io/.github/"
      },
      {
        "id": "2db81398-e82d-4336-a11e-3fe4ae70333e",
        "name": "https://github.com/Arctic-Wolf-Security"
      },
      {
        "id": "fa98e62b-4350-4840-b3f2-34910dc94a2d",
        "name": "https://github.com/malwarebytes-protection"
      }
    ]
  },
  "external_refs": [
    {
      "id": "777f59eb-27c1-4f50-b05f-5f63e9478806",
      "standard_id": "external-reference--376815cc-9039-57cc-8711-d01f53571df0",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://arcticwolf.com/resources/blog/security-bulletin-github-impersonation-deploys-information-stealer/",
      "hash": null,
      "external_id": null,
      "created": "2026-07-03T07:23:44.894Z",
      "modified": "2026-07-03T07:23:44.894Z",
      "createdById": null
    },
    {
      "id": "e2d6545b-1090-4ca5-a0db-d54889aca7ae",
      "standard_id": "external-reference--8a3bd1d2-46ae-5dc1-8699-1a6e250ca811",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a468e99941f9e2f4d672d80",
      "hash": null,
      "external_id": "6a468e99941f9e2f4d672d80",
      "created": "2026-07-03T07:23:44.866Z",
      "modified": "2026-07-03T07:23:44.866Z",
      "createdById": null
    }
  ]
}