222 GitHub Repositories Linked to Fake Go Package Malware Operation

Researchers uncovered an organized campaign—tracked as “Muck and Load”—that used 222 GitHub repositories and a malicious Go module to masquerade as legitimate projects and deliver a staged malware chain (loaders, Vidar-like stealers, RATs, and XMRig cryptominers). The operation relied on automated GitHub Actions to fabricate active development, public dead-drop sources for encrypted payload locations, and multi-stage PowerShell loaders that disable execution policies and extract password-protected payloads from GitHub releases; platform owners have been notified and some artifacts were blocked.