{
  "name": "Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories",
  "slug": "malicious-go-module-exposes-github-malware-lure-network-spanning-222-repositories",
  "description": "A malicious Go module posing as a DNS/subdomain scanner exposed a sophisticated Windows malware staging operation utilizing commit-farming workflows, public dead drops, and protected archives to deploy RAT and infostealer malware. The operation, tracked as 'Muck and Load', leverages a GitHub-based infrastructure comprising 222 confirmed repositories across 190 accounts designed to appear active and legitimate through automated GitHub Actions workflows. The attack chain begins with a deceptive Go module that downloads encoded PowerShell content, which then queries multiple public platforms including Pastebin, Telegram, YouTube, and Instagram as dead drops for encrypted payload locations. The loader retrieves password-protected archives containing AsyncRAT, Quasar, Remcos, and Vidar infostealer payloads, executing them from masqueraded Microsoft-themed directories. At least 14 malware files were confirmed across the repository network.",
  "published": "2026-07-09T08:24:59.786000+00:00",
  "created_at": "2026-07-09T11:23:26.722000+00:00",
  "modified_at": null,
  "created_at_opencti": null,
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "asyncrat",
    "commit farming",
    "dead drop resolver",
    "github lure network",
    "go module",
    "operation muck and load",
    "powershell loader",
    "quasar",
    "remcos",
    "vidar",
    "xmrig"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "22d97083-2498-4993-9f7f-73755b6a489a",
        "name": "http://muckcoding.com/LG-LW/Api-Certificate"
      },
      {
        "id": "d438c3f4-fcc0-4657-b272-80b5fde558c7",
        "name": "969b0bfd605aa2cddf353f3638b0dee26b1c2305600231e055fa6d7786a879fe"
      },
      {
        "id": "15ac8f4c-e187-4e5f-883d-edaae9a77611",
        "name": "45126b353f1636103da356121cd00b229b635b41b99d91166e6d7d9037482242"
      },
      {
        "id": "d0cc90af-c1f4-4fda-9e5b-e8908284be85",
        "name": "b27f694c974b44fe2f4a8a25680997db574fa35686c30fa4c4dc9dd4ec40005e"
      },
      {
        "id": "3c630827-ff1c-4b8a-be68-58d91e6c65bb",
        "name": "ec1cac2ada6726623b4bafb94c204c359ce7cdf5325909137fc0e6aef506783f"
      },
      {
        "id": "e06712ed-83b2-4fd5-8684-b73ea75c2e2a",
        "name": "muckdeveloper.com"
      },
      {
        "id": "ac10c656-42c2-4a9a-8617-03cd04ec421c",
        "name": "e576a61e1a2ba71e764647bb2f0883c2f8fa4d591799c60d21a84230ee7a5b63"
      },
      {
        "id": "1afdc7a4-3668-488c-886b-932d360469e9",
        "name": "51cada347262d7b2bcde70552fcdae221625ad75435cee8a9c3e7b67cc47a807"
      },
      {
        "id": "4c37ba99-5f99-4d04-89ad-ded417d32440",
        "name": "938054c6bb7dc737fce16513b2882808f199c2f892f808d439525a1650d49089"
      },
      {
        "id": "169c2d3f-427a-4240-83a9-e99732e382fe",
        "name": "a628ad47fe93ee7413cca90aeca8f9540bfcd5ccdbeb4d9914670b3ef66247f4"
      },
      {
        "id": "83506b98-7bbd-4585-8618-881e959062ba",
        "name": "9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7"
      },
      {
        "id": "358c340f-6ad9-4778-b083-d48e73631318",
        "name": "a2e7989742c6b6436ebb47507881946e4f662080dff71d104eb9a9554f38af7a"
      },
      {
        "id": "0cf5838e-b7b8-4406-9193-c7dc76ff248e",
        "name": "https://muckcoding.com/LG-LW/Api-Certificate"
      },
      {
        "id": "8b106d12-1665-445b-8515-b3ad30107b7e",
        "name": "129de16fe69763f767d8249279a2c4a1a6deafadd1a84563bd84b258ea010bff"
      },
      {
        "id": "b9e928ef-6b82-437f-b944-6b196447dd42",
        "name": "86819efe7319b664920ba2e1fd4b079a4e6b5eaaebeeb1adb2c1c8dc3c81ee0c"
      },
      {
        "id": "9f8e16ad-99d6-4f0b-a9f8-8721d055d439",
        "name": "d95bba20f04687b0b821d4fc0a17137db8b9eda5fe3fb34da319abefc45fe0d1"
      },
      {
        "id": "e2aa57ac-bc82-430e-a3d5-6407ea273f15",
        "name": "d7747e7a3c782009f4ceb6e9c106115876386853929563b509da5258e3968d15"
      },
      {
        "id": "f1f4ad89-4330-47be-88cd-65c51180c0cf",
        "name": "57e0449fb13766b0b2f7c057b1f89911e9ed23cac7e71d5d69fde47571239629"
      },
      {
        "id": "f03b0ad9-a7fb-4607-86a2-0d4dc53df0fa",
        "name": "https://rlim.com/MicrosoftCur/raw"
      },
      {
        "id": "2e5e3caa-4856-4fe0-b071-00c7e1421f50",
        "name": "810614290bdb14d2ddf10f65f8adc988a8272764f2a9e2c378e52fad162da344"
      },
      {
        "id": "bda655ff-12c9-48c5-a0b7-9eb8147b19bb",
        "name": "235a64e3520b1c2c27763122b303f78aee8d7c083dfd9f1eb936cd5174383609"
      },
      {
        "id": "6598763f-9767-4baa-84b3-59a8b7547f2a",
        "name": "https://muckdeveloper.com/LGTV/MicrosoftCur"
      },
      {
        "id": "7fcbed65-ecf1-4752-8221-7c6cbabd12fc",
        "name": "rlim.com"
      },
      {
        "id": "ef71d857-e6f4-41c3-aff4-8c5930a34734",
        "name": "e73491065d86b1ad69229bb5d2019e08b947e11a2a57adf5c2d9a2b5d8f4acad"
      },
      {
        "id": "96fe62b2-7398-4bcf-b759-5de35d98884e",
        "name": "2f416aac027f19f563cc45e3b4b72e992aaafb63da27f968b9a76a391134dc7d"
      },
      {
        "id": "c5cd37ff-df91-4013-a2cf-635f9c1a1442",
        "name": "muckcoding.com"
      },
      {
        "id": "7db88d51-6df7-4fd1-85d0-9061dddaedb7",
        "name": "4ea1c577247b149489506b230e7aa203e1a2fa124109c6056d1986e944f520a4"
      },
      {
        "id": "f56c2893-8d1b-4355-a080-cf13344a8f34",
        "name": "f245956c930f220f0bedf355a751a5cd738b4ec6bb6c5d584199ab3fa6c0a1c4"
      },
      {
        "id": "f929a6f9-98a0-4810-bb89-790ed4f62050",
        "name": "73c807df26427d6631088a822fa54c30975afbe681a9d83eff5d19e5b075d6c2"
      },
      {
        "id": "420ac178-7c20-44c8-a448-76cf62e5781c",
        "name": "33497c69c21fa96bbc96f1d7f09608e462f8ab22555364977c0bd35fef27bc29"
      }
    ],
    "attack_patterns": [
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "d3254e3b-07e6-4420-96e0-2e107ce17712",
        "name": "T1102.001"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "b7ba0db0-7d4f-436f-8d5f-c431d690b048",
        "name": "T1555.003"
      },
      {
        "id": "d048ac4b-dd28-4c66-b62b-fe25cefef481",
        "name": "T1548.002"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "ef72da1d-2eaa-4d94-8913-06978609cfb4",
        "name": "T1608.001"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "0b534d7b-0850-41a7-9bc5-f2e6162eea42",
        "name": "T1195.001"
      },
      {
        "id": "dea4e00b-6e38-4223-a0f2-8a44e403019b",
        "name": "T1564.003"
      },
      {
        "id": "b15c00da-c412-4429-900c-659de612baf5",
        "name": "T1543.003"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      }
    ],
    "malware": [
      {
        "id": "c65c9a1e-715b-4b83-96b3-e8906fa14da4",
        "name": "Quasar",
        "slug": "quasar"
      },
      {
        "id": "f200fb60-5446-493f-9712-9f26d65956cc",
        "name": "AsyncRAT",
        "slug": "asyncrat"
      },
      {
        "id": "2c582ed8-35df-4ef9-917d-994e214aa5f9",
        "name": "Vidar",
        "slug": "vidar"
      },
      {
        "id": "f8f32f39-7be0-41b8-8758-e913d3bd5f92",
        "name": "XMRig",
        "slug": "xmrig"
      },
      {
        "id": "29d292f7-f50d-4c23-900d-035ab7488290",
        "name": "Remcos",
        "slug": "remcos"
      }
    ],
    "observables": [
      {
        "id": "01aae62e-6243-4d44-b24a-cc3b3e3f34aa",
        "name": "muckcoding.com"
      },
      {
        "id": "fd35225f-0c12-4af2-9441-0dc82a84a30c",
        "name": "rlim.com"
      },
      {
        "id": "6b864ecc-6a5f-4a39-b948-10c6488ff359",
        "name": "muckdeveloper.com"
      },
      {
        "id": "94e83387-9712-4bc7-ab80-431b0df6c2c4",
        "name": "https://muckcoding.com/LG-LW/Api-Certificate"
      },
      {
        "id": "735a9383-d8f0-4e06-9011-9e141b2f3bb8",
        "name": "http://muckcoding.com/LG-LW/Api-Certificate"
      },
      {
        "id": "8495f9e2-cdd9-45ff-a215-2524aaf186de",
        "name": "https://muckdeveloper.com/LGTV/MicrosoftCur"
      },
      {
        "id": "d6431a1d-d894-431f-8a8c-4d5fcaec3260",
        "name": "https://rlim.com/MicrosoftCur/raw"
      }
    ]
  },
  "external_refs": [
    {
      "id": "de0f1bd2-8512-45fb-b374-7041ea32efd4",
      "standard_id": "external-reference--3667363c-0840-513a-9354-9a80c59a0365",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://socket.dev/blog/malicious-go-module-exposes-github-malware-lure-network",
      "hash": null,
      "external_id": null,
      "created": "2026-07-09T11:23:24.025Z",
      "modified": "2026-07-09T11:23:24.025Z",
      "createdById": null
    },
    {
      "id": "60d0a420-b68d-4444-a2fb-bde77b90bd0a",
      "standard_id": "external-reference--b64ca389-aec7-5b28-aad0-6a940783f770",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a4f5adbd8cb65e0d44c0d53",
      "hash": null,
      "external_id": "6a4f5adbd8cb65e0d44c0d53",
      "created": "2026-07-09T11:23:23.938Z",
      "modified": "2026-07-09T11:23:23.938Z",
      "createdById": null
    }
  ]
}