Malicious GitHub Campaign: Fake “Arctic Wolf” and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer

Since 26 June 2026, an unattributed financially motivated actor published ~292 brand‑impersonation GitHub repositories to lure users to a templated fake “secure download” page that serves a ZIP containing a signed WinGUP updater and a trojanized libcurl.dll which side‑loads and reflectively executes an in‑memory BoryptGrab‑lineage infostealer; the stealer runs 11 theft modules (browser credentials and cookies, 41‑entry crypto wallet paths, Telegram/Discord/Steam/Meta Max data, file grabber, screenshots, Windows Credential Manager) and exfiltrates archives to a hardcoded C2 (193.143.1.131, Proton66, Russia), leaving forensic staging folders on disk and requiring defenders to block C2s, hunt for gup.exe side‑loads, and rotate credentials.