Fake GitHub Repositories Unleash BoryptGrab Stealer and TunnesshClient Backdoor

BoryptGrab is a widespread campaign that lures victims via SEO-optimized GitHub repositories offering fake “free” tools; the downloaded ZIPs install an infostealer that harvests browser credentials, crypto wallets, messaging tokens, and files, and may deploy a PyInstaller backdoor (TunnesshClient) that creates reverse SSH tunnels and a SOCKS5 proxy for attacker traffic. TrendMicro researchers observed dozens of repositories and code/infrastructure clues (Russian-language comments and Russia-hosted IPs) linking the operation to Russian-speaking actors.