292 Malicious GitHub Repos Spread BoryptGrab Infostealer

ArcticWolf discovered 292 malicious GitHub repositories spoofing legitimate tools to deliver a new BoryptGrab infostealer variant. The malware steals data from 19 browsers, 32 crypto wallets, messaging apps, Steam, and Windows Credential Manager, and uniquely bypasses Chrome's App-Bound Encryption via code injection. Most repos have been removed, but some remain active.