Fake DeepSeek TUI GitHub Repositories Deliver Malware

Key Takeaways

• Threat actors are distributing malware by impersonating popular AI tools, including DeepSeek TUI, on GitHub.
• Fake repositories mimic legitimate projects to trick developers and AI enthusiasts into downloading malicious 7z archives.
• The malware, identified as a Rust-written variant of the OpenClaw family, disables Windows Defender, establishes multi-stage persistence, and evades sandbox detection.
• Numerous other AI-themed installers, such as those for Claude, Grok, and WormGPT, are linked to the same attack infrastructure, indicating a broad campaign.
• Users are advised to rigorously verify GitHub repository authenticity and implement robust endpoint detection to mitigate risks.

Cybersecurity researchers have uncovered a new campaign where threat actors are exploiting the popularity of AI tools by creating counterfeit GitHub repositories to distribute malware. The latest target in this sophisticated scheme is DeepSeek TUI, a legitimate terminal-based intelligent agent designed for interacting with DeepSeek large language models.

The timing of this attack aligns with a surge in interest following the release of DeepSeek v4 and widespread discussions by developer Hunter Bown within Chinese tech communities. This heightened visibility made DeepSeek TUI an attractive target for cybercriminals seeking to capitalize on trending AI software.

This tactic mirrors a growing trend in the developer ecosystem where malicious actors construct highly convincing fake GitHub repositories. These fraudulent pages are meticulously designed to resemble authentic projects, deceiving unsuspecting users into downloading malicious software. In this particular instance, the malware was embedded within a 7z compressed archive, presented as a standard software release on the fake repository’s Releases page.

Researchers at the QiAnXin Threat Intelligence Center were instrumental in detailing this campaign. They observed that the malware’s functionalities closely resemble those of OpenClaw, a previously documented spoofing attack that QiAnXin exposed in March 2026. The reuse of command-and-control (C2) domain names from the earlier OpenClaw campaign strongly suggests that the same threat actor is behind these ongoing and evolving operations.

A particularly alarming aspect of this campaign is the extensive array of fake AI-themed installer names associated with the same attack infrastructure. Beyond DeepSeek TUI, investigators discovered fraudulent files masquerading as popular tools like Claude, Grok, WormGPT, KawaiiGPT, and FraudGPT, among others, all pointing to a unified threat landscape.

Fake DeepSeek TUI Repository Used as Malware Delivery Point

Analysis of the malicious samples revealed a shared PDB path, “ClawCode.pdb,” linking all identified executables to a common Rust-written malware family. This consistent signature indicates a coordinated threat actor who systematically rotates spoofing targets to maximize impact.

The primary malware file in question, DeepSeek-TUI_x64.exe, with an MD5 hash of b96c0d609c1b7e74f8cb1442bf0b5418 and a compilation timestamp of April 29, 2026, initiates its malicious activities with a thorough environment check. This initial phase is designed to detect virtual machines, known analysis tools, or other suspicious system characteristics indicative of a sandbox environment. If such conditions are met, the malware displays a deceptive message, “Sorry, your system does not meet the minimum requirements,” and terminates silently to avoid detection.

Upon confirming it is operating on a genuine user system, the malware proceeds to disable critical Windows Defender protections. This is achieved through an XOR-encrypted PowerShell script that adds six folder exclusions, deactivates cloud-based reporting, halts behavior monitoring, and opens three inbound firewall ports: 57001, 57002, and 56001. The string decryption key “xnasff3wcedj” is used in the sample, and the malware subsequently retrieves second-stage payloads hosted on Azure from Pastebin and snippet.host links.

The downloaded second-stage components each play a distinct role in maintaining the attacker’s foothold. OneSync.exe and WinHealhCare.exe are responsible for installation, setting up scheduled tasks, and reporting back to the attackers via Telegram. The onedrive_sync.exe component ensures persistence by modifying the Windows Run registry key. Meanwhile, svc_service.exe functions as the core resident component, utilizing NT syscalls for thread injection and loading .NET assemblies directly into memory to evade traditional detection mechanisms.

Multi-Stage Persistence and Anti-Sandbox Evasion

The campaign’s sophisticated use of multiple persistence mechanisms significantly complicates the removal of the malware once a system has been compromised. The malicious code is designed to survive system reboots and other disruptions by leveraging scheduled tasks, registry Run keys, Winlogon hooks, and startup shortcuts.

A second-stage loader, autodate.exe, further enhances stealth by posing as a service manager while covertly injecting payloads into memory. The command-and-control (C2) domains identified in this operation are mikolirentryifosttry.info and zkevopenanu.cfd.

What You Should Do

• Verify Repository Authenticity: Always scrutinize GitHub repositories before downloading any files. Check the account age, commit history, and the number of genuine contributors. Look for official links from the project’s primary website.
• Exercise Caution with New/Trending Tools: Be especially wary of newly released or trending AI tools, as these are frequently targeted by threat actors.
• Implement Endpoint Detection and Response (EDR): Deploy EDR solutions capable of monitoring for memory injection techniques, unusual PowerShell activity, and unauthorized changes to security settings.
• Maintain Strong Security Practices: Keep operating systems and security software updated. Use robust antivirus and antimalware solutions.
• Educate Users: Inform developers and AI enthusiasts about the risks of downloading software from unverified sources and the importance of supply chain security.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.