GitHub hosts malware too

A search for a well-known app that lands on github.com feels like arriving at the source. It is not. GitHub is a hosting provider, not a curator: anyone can open an account, publish a repository, and serve files from one of the most trusted domains on the web. Attackers know this, and they build on it. Repositories, organization profiles, and free *.github.io websites are all in play.

Brand impersonation is routine

The fakes do not just copy the marketing. They borrow the brand, and both closed-source and open-source projects get copied:

• CCleaner (proprietary): a GitHub Pages site at ccleaner-professional-update.github.io styled itself “CCleaner Professional”, with a feature list, an FAQ, and a big “Install CCleaner” button. The button left GitHub for a lookalike domain (gitlab.life, wearing a second brand’s name) that served a password-protected archive, password gitlab. A small-print footer called the site “an independent informational project”. Whatever the archive holds, it does not come from the people who make CCleaner. Archived capture of the fake CCleaner Pages site.
• Notepad++ (open source): a GitHub organization named NotepadPlus-Text-Editor-Download offered the “Official Windows installer for Notepad++”, with download buttons and a claimed MIT license. The real Notepad++ is GPL-licensed and lives in a repository with two decades of history. This one’s profile README even printed a section titled “SEO Keywords”, stuffing in phrases like “notepad plus plus download” and “free text editor for windows”. Archived capture of the fake organization profile.

Read these captures, but do not click inside them. The Wayback Machine preserved the pages; the download buttons still resolve to live attacker infrastructure. Treat every link inside them as hostile.

These two are not outliers. In July 2026, Arctic Wolf Labs documented one actor behind at least 292 repositories impersonating software vendors, security companies, and developer tools, Arctic Wolf included. Every repo concealed a download link that hopped through a GitHub Pages address to an outside domain serving the BoryptGrab infostealer, the same shape as the CCleaner fake above. Arctic Wolf’s write-up.

Impersonation is not the only shape. SwiftClean borrowed no brand at all: it invented one, announced itself on Reddit as a “free and open-source MIT” cleaner for Windows and macOS, and shipped a password-protected zip while its repository held no source code. Manual analysis confirmed the payload malicious, the only confirmed malware in this catalog so far. Same host, same tricks, no impersonation required.

Why attackers pick GitHub

The same properties that make GitHub the default home of real software make it a comfortable home for the fake kind:

• It ranks. github.com is an old, high-reputation domain that search engines place well, so a fake repo or Pages site can sit next to (or above) the project’s real home for the right query.
• It is free. Free accounts, free repositories, free release hosting, free websites at *.github.io. The entire scam runs on a budget of zero.
• Security tools are gentle with it. Files served from github.com inherit the domain’s reputation, so automated URL and download screening treats them better than a fresh domain would get.
• Users trust it. “It’s on GitHub” reads as legitimacy, even though GitHub never vouched for anything.
• Users expect unsigned software. Plenty of real, respected projects ship unsigned binaries, so clicking through the operating system’s warning feels routine. The scam asks for nothing a legitimate repo does not. Even a valid signature proves little: one documented campaign paired a legitimately signed updater with a malicious DLL it loaded at runtime.
• Accounts are disposable. Sign-up is fast and free. When one account is reported and removed, the next upload is already live somewhere else.
• New is normal here. A two-week-old domain is a red flag; a two-week-old repository is just a launch, because every legitimate project started exactly that way. GitHub is where new real software appears, which is exactly why the age signal barely works.

Even the history is manufactured

The freshness signal can be counterfeited too. Another repository dressed as Notepad++, abovedaemons-59/Notepad, showed dozens of commits, all authored by github-actions[bot], each with a plausible generated message and an issue number like “#4268” implying thousands of issues that do not exist. Open any of them and the diff is one line: a “Last updated” timestamp in the README, bumped by a few hours. The repository reports a fresh last-commit time and a healthy commit count without ever changing anything. Archived commit history.

They are not hiding

None of this took any finding. GitHub’s own search box returns the same shape: a query for free download full version crack lists repositories named exactly that, like bludmoon43/aomei-partition, titled “AOMEI Partition Assistant Crack | Free Download Full Version”, a README of keywords and one “Click Here” link leaving GitHub, still up twenty months after it was created. Google finds them just as fast: site:github.com free cracked full download official returns pages of the same.

Which means detection is not the bottleneck. GitHub indexes all of this already; a five-second keyword search available to anyone is available to it. When fakes this visible stay up for months at a time, the gap is priorities, not capability.

The tells

No single sign is proof, and honest projects will trip one or two. Together they draw the shape:

• Everything is new. The repository is days or weeks old, and so is the account behind it: created recently, no history, no other work.
• The name is a search query. Repository, organization, and account names stuffed with “free”, “cracked”, “official”, “latest”, “download”, and the current year. The Notepad++ fake named its organization NotepadPlus-Text-Editor-Download and printed its keyword list in the README.
• Nobody is watching. A claimed “official” home of a famous app with a star count under 100, no forks, no real issues. The real Notepad++ repository counts its stars in the tens of thousands.
• The activity is theater. A padded commit count and a fresh last-commit date mean little if every commit is a bot bumping a timestamp, like the history above. Open two or three commits and check whether anything actually changed.
• The download is password-protected. An encrypted archive hides its contents from antivirus inspection. Both fakes above, and confirmed malware SwiftClean, used one.
• The link leaves GitHub. A download button that hops to an unrelated domain is the scam stepping out from behind the borrowed trust.
• Badges are asserted, not verified. The impersonation campaign’s download pages wore labels like “VirusTotal Approved”, “Secure Archive”, and “Verified Access” that no one had granted. A badge is a claim; check who issued it.
• “Official” is asserted, never shown. The real project links to its repository from its own website. The fake just uses the word. If the page lies about who publishes it, the payload has already failed the first check.

What to do instead

• Reach the download from the vendor’s own site, not from a search ad or a README button.
• Treat a GitHub result as a lead, not an endorsement: check the account age, the project’s history, the stars, and whether the official site links back.
• Prefer sources that put a maintainer between you and the file: the vendor’s site, your operating system’s package manager, an established distribution.
• Report the fake. GitHub accepts abuse reports, and impersonation repositories do get removed.
• If one of these archives already ran on your machine, treat the machine as compromised. It asked for a password so that nothing could look inside.

The takeaway

GitHub the company removes reported abuse, and pre-screening a firehose of new accounts and repositories is genuinely hard; it never claimed to. Still, the fakes above are not the hard part of the firehose: they are the part a five-second keyword search finds. A github.com URL tells you where a file is hosted, not who vouches for it. The rest of the checklist lives at is this a good cleaner?.

Last reviewed 2026-10-31