Daily Threat Intel by CyberDudeBivash
Zero-days, exploit breakdowns, IOCs, detection rules & mitigation playbooks.

Follow on LinkedIn Apps & Security Tools

CyberDudeBivash Pvt Ltd | Threat Intel | Supply Chain | GitHub Malware

Fake OSINT/GPT Tools on GitHub Are Stealing Your Data with PyStoreRAT Malware

Author: CyberDudeBivash | Published: 13 Dec 2025 (IST) | Category: Supply-Chain & Developer Security

Official URLs: cyberdudebivash.com | cyberbivash.blogspot.com | cyberdudebivash-news.blogspot.com

Defensive-Only Notice: This report is for awareness, detection, and mitigation. It does not include exploit payloads, weaponized scripts, or step-by-step instructions that enable abuse.

Affiliate Disclosure: Some links in this post are affiliate links. If you purchase through them, CyberDudeBivash may earn a commission at no extra cost to you.

TL;DR (What’s happening right now)

Threat: Malicious GitHub repositories disguised as OSINT tools, GPT utilities, and developer helpers are spreading a modular malware family dubbed PyStoreRAT.
Trap: The repos often contain minimal “loader” code and polished documentation to look legitimate and attract real users.
Execution: Campaigns documented by researchers include multi-stage delivery using Windows scripting features (including HTA execution).
Impact: Data theft and remote access—especially dangerous for IT admins, OSINT researchers, and developers with privileged access.
Fix: Treat GitHub tools like untrusted software: sandbox first, verify provenance, restrict script execution, and harden developer workstations.

Emergency Defense Stack (Recommended by CyberDudeBivash)

Kaspersky (Endpoint/EDR)
Behavioral detection against droppers, HTA/script abuse, and data stealers.Edureka (Cybersecurity Training)
Upskill teams on supply-chain defense and incident response.AliExpress (Lab Equipment)
Build a safe sandbox lab: adapters, storage, and IR accessories.CyberDudeBivash Apps & Products
Security audits, incident playbooks, and hardened workflows.

1) Campaign Overview: Why Fake GitHub Tools Work

GitHub has become the default “app store” for technical professionals. If you are an OSINT analyst, a SOC engineer, a developer building quick automation, or an IT admin searching for a helper script, the workflow is predictable: search, clone, run, move on. Attackers are exploiting that trust.

Researchers have documented a coordinated operation abusing GitHub repositories that appear to be OSINT tools, GPT wrappers, developer utilities, DeFi bots, and security-themed scripts. The repositories can look legitimate: polished READMEs, realistic feature lists, and clean branding—often with only minimal code that fetches the real payload.

One reason this works so well is that “tool curiosity” is part of the job. OSINT professionals install new tools daily. Developers test utilities constantly. That creates a perfect storm: high execution rate, high privileges, and sensitive environments.

CyberDudeBivash warning: In 2025, running unknown GitHub code on your main workstation is equivalent to opening an unknown attachment as admin. Assume hostile until proven otherwise.

2) What is PyStoreRAT?

PyStoreRAT is a recently reported malware family described as modular and multi-stage, used to establish remote access and enable follow-on malicious activity. Reports note it can support multiple module types and execution paths, making it adaptable across environments.

Multiple outlets covering the research highlight that the campaign leans on deceptive GitHub repositories, where the visible code is often tiny, while the real behavior happens after execution through scripts that retrieve and run additional components.

This is not just a “random stealer.” The strategic value is that it targets people who already have access: admins with RMM tools, engineers with cloud credentials, analysts with investigation data, and developers with secrets in environment variables, configuration files, and private repositories.

3) High-Level Infection Chain (Defensive)

The technical details vary by repository, but the defensive story remains consistent: a believable tool is published on GitHub, and the initial code acts as a loader to pull down and execute additional content. Researchers specifically observed use of Windows scripting features to run remote content as part of the chain.

The attacker does not need a zero-day if you run the “tool” yourself. This is why supply-chain and “repo poisoning” tactics are so dangerous: user intent becomes the exploit. In many environments, developer workstations also have relaxed controls (local admin, script execution allowed), increasing the success rate.

What defenders should focus on: initial execution events, script interpreters, remote content retrieval, new persistence entries, and abnormal outbound connections soon after running unknown code.

4) Who’s Targeted and Why It’s High Impact

Reporting on this campaign emphasizes that it targets IT and OSINT professionals—people who routinely evaluate new tools and often have privileged access.

OSINT researchers: handle sensitive investigative data and often install numerous third-party tools quickly.
Developers: hold secrets (API keys, tokens), access CI/CD pipelines, and can introduce supply-chain contamination.
IT admins: have high privilege and reach—RMM tools, domain access, and server credentials.
Security teams: possess IR data and can inadvertently leak internal indicators, cases, and threat research.

In practical terms, a single compromised workstation in these groups can become an identity breach, a cloud breach, and a lateral movement springboard. That is why this campaign should be treated as an enterprise identity and security posture issue, not just “malware on one PC.”

5) What Data Gets Stolen

Public reporting indicates the campaign is associated with data theft behavior and may deliver additional payloads depending on the victim profile. From a defender’s standpoint, assume exposure of the “developer workstation crown jewels”:

Browser-stored secrets (session tokens, saved passwords, extension data)
Cloud credentials in environment variables and CLI config
SSH keys, Git credentials, and repository tokens
Crypto wallet artifacts where present
Internal documents, incident notes, and investigation artifacts

Risk framing: This is an “identity + secrets breach” threat. If a user ran a fake repo, do not only clean the host—rotate credentials and revoke sessions across your cloud and identity stack.

6) Detection Signals: What to Hunt For

Because repo-based malware starts with a user running code, early detection is about correlating execution events with network and identity telemetry. News and research write-ups describe a multi-stage chain and modular behavior, which means defenders should look for “staging patterns” rather than one fixed file hash.

6.1 Endpoint telemetry (high confidence)

Execution of script interpreters immediately after cloning/downloading repos.
Unexpected use of Windows scripting features to run remotely retrieved content.
New persistence entries soon after “tool testing” activity.
Suspicious child processes spawned from developer shells or IDE terminals.

6.2 Network telemetry (cross-check truth)

New outbound connections shortly after a repo is executed, especially from workstations that do not normally run unknown code.
Connections to newly registered or low-reputation domains and rotating endpoints.
Unusual traffic patterns from endpoints that appear “idle.”

6.3 Identity telemetry (blast radius signals)

New OAuth grants or API tokens created unexpectedly.
Suspicious logins or token usage from unusual geography/IP after workstation compromise.
Repository access spikes, CI/CD token use, or secret retrieval anomalies.

7) Mitigation: Hardening Dev/OSINT Workstations

This is the defensive shift you must make: treat “random GitHub tools” as untrusted software until validated. Researchers documented this campaign specifically abusing GitHub trust and convincing repository presentation, which means policy and process matter as much as malware signatures.

7.1 Enforce a safe testing environment

Require sandbox execution (VM) for unknown tools.
Block direct execution on admin workstations and production laptops.
Separate “research workstation” from “privileged workstation.”

7.2 Reduce script attack surface

Restrict Windows scripting interpreters where not required (policy-based allowlists).
Monitor and alert on abnormal script execution from user directories and repo folders.
Use EDR tamper protection and block suspicious child-process chains.

7.3 Secrets hygiene (the real win)

Move secrets to managed vaults; avoid storing long-lived tokens on endpoints.
Shorten token lifetimes; require re-authentication for sensitive actions.
Deploy secret scanning for repositories and CI/CD systems.

CyberDudeBivash Professional Services: Developer workstation hardening, GitHub supply-chain risk assessment, and IR playbooks.

Explore Apps & Products Request Consultation

8) GitHub Safety Checklist (Before You Run Any Tool)

Check	What to Verify	Why It Matters
Repository identity	Owner history, prior projects, consistent activity	Dormant or newly created accounts are common in repo abuse campaigns
Code-to-README match	Does the repo contain real implementation or just a tiny downloader?	Researchers reported repos with minimal code but convincing presentation
Dependency safety	Pinned versions, no unknown package sources	Supply-chain risk often hides in dependencies, not main code
Execution environment	Run in a VM/sandbox first; block access to real credentials	If the tool is malicious, it should not reach secrets
Network behavior	Does it call out to unknown hosts during “install” or “setup”?	Multi-stage loaders rely on external fetch-and-execute

9) Incident Response: If Someone Ran a Fake Repo

If a user cloned and ran one of these repos on a real workstation, act fast. Based on how researchers describe the campaign as modular and multi-stage, your priority is to stop further execution, cut off command-and-control, and assume credential exposure.

First 60 minutes (containment)

Isolate the host (network quarantine or disconnect).
Preserve evidence: EDR timeline, Windows event logs, DNS logs, proxy logs.
Revoke sessions and rotate credentials for accounts used on the machine (SSO, cloud, Git, email).
Check for new OAuth grants, tokens, SSH keys, and unusual access patterns.
Hunt for similar execution patterns across endpoints (same repo names, same parent processes).

Recovery (trust restoration)

If malicious execution is confirmed or highly suspected, rebuild the endpoint from known-good media.
Validate CI/CD and repo integrity: check for injected secrets, new deploy keys, or modified workflows.
Implement a “sandbox-first” policy for tool testing and restrict script execution where possible.

FAQ

Does GitHub scanning stop this automatically?

Not reliably. Attackers can rotate repos, accounts, and delivery methods. Treat GitHub as a hosting platform, not a trust guarantee. This is why researchers highlighted convincing repos with minimal malicious-looking code.

Why target OSINT and GPT tooling?

Because these audiences execute new code frequently and often handle sensitive data or have privileged access. Reports specifically mention OSINT/GPT-themed repos used to lure victims.

What is the safest way to test a new tool?

Use an isolated VM with no corporate tokens, no saved browser sessions, and restricted outbound access. Observe network calls and process behavior before any production use.

References

Threat research write-up (Morphisec Threat Labs) — campaign details and targeting context
The Hacker News coverage — fake GitHub OSINT/GPT repos distributing PyStoreRAT
SC Media brief — summary of malicious repos and execution behavior
SiliconANGLE coverage — campaign overview and abuse of trusted platforms

Partners Grid (Recommended by CyberDudeBivash)

Rewardful (Affiliate Tracking)YES Education Group GeekBrains Clevguard (WW)VPN hidemy.name Apex Affiliate (AE/GB/NZ/US)

CyberDudeBivash Ecosystem:
cyberdudebivash.com | cyberbivash.blogspot.com | cyberdudebivash-news.blogspot.com

#CyberDudeBivash #PyStoreRAT #GitHubMalware #SupplyChainSecurity #OSINT #GPTTools #DeveloperSecurity #Infostealer #ThreatIntel #EndpointSecurity #ZeroTrust

Official Hub: https://www.cyberdudebivash.com/apps-products/

Cyberdudebivash