Backdoor hides in fake Fscan tool

Dr. Web found a GitHub repository advertising a lightweight script to parse, clean, and format output from the Fscan network scanner. Behind long stretches of whitespace in the project’s source sat code that pulled down a backdoor and an information stealer. More than 2,000 Windows machines have been compromised. The recent repositories are aimed at cybersecurity professionals: tools for network scans, security testing, and log analysis.

The campaign is about two years old. It started against crypto wallet users with blockchain games, bots, and cheat tools, then the operator shifted to repositories aimed at security work. Someone who downloads a tool to clean up Fscan output is more likely to run it on a privileged box and less likely to treat an odd build step as suspicious.

The malicious code hides in Visual Studio project files, Python scripts, and Go source. The whitespace trick pushes the payload far to the right of the visible code so it does not show up in a casual scroll, an old technique that still works. In some Visual Studio projects the code runs as a pre-build event, so it executes when you build the project, before there is any binary to scan.

From there the chain is PowerShell fetching an encrypted download link, which pulls a modular Electron-based loader named Microsoft.exe. The loader sets up persistence, elevates privileges, turns off Windows security and recovery features, and injects the next stage into legitimate processes.

The loader’s default behaviour, which Dr. Web calls Mode3, runs six evasion steps:

• Spoofs its parent process so explorer.exe appears to have launched it.
• Flips a registry value to disable Smart App Control.
• Reloads clean ntdll.dll from disk to strip out hooks that security software installed.
• Issues direct Windows system calls that are harder for security tools to intercept.
• Patches EtwEventWrite in memory to kill event tracing in its own process.
• Patches AmsiScanBuffer in memory so AMSI stops scanning scripts.

If Mode3 fails to launch, the loader falls back to Mode2, which adds Microsoft Defender exclusions and uses a PowerShell script to decrypt and inject the payloads into RegAsm.exe.

The payloads are the AsyncRAT backdoor, a clipper that swaps crypto wallet addresses in the clipboard, and an infostealer. The stealer takes browser data, VPN settings, FTP client configuration files, gaming account data, and Discord tokens, and ships them out through a Telegram bot. The malware also tries to uninstall ESET, McAfee, and Malwarebytes, cut those products off from their update servers, and interfere with Windows backups. Dr. Web found one more piece, seemingly unfinished, meant to keep the loader alive and re-download it if someone deletes it from disk, which suggests the operator is still adding features.

The takeaway for anyone running these systems: a repository that tidies up your scanner output is still code you are about to execute on a security workstation, often the most privileged machine on the network. Read the source before you build it. The hiding spots here are specific, so check them directly: pre-build events in Visual Studio project files, and lines in Python and Go source that run long past the visible margin behind whitespace. The evasion is built against in-process defenses. It restores clean ntdll from disk, makes direct syscalls, and patches AMSI and ETW in memory, so security tooling that relies on user-mode hooks inside the target process has less to work with once the loader runs. Dr. Web published a full list of indicators of compromise for this campaign; that is the fastest way to check whether any of this has already run on your machines.