Netskope Details TroyDen Malware Lures on GitHub
Netskope Threat Labs reported on March 23 that a campaign it calls TroyDen's Lure Factory used more than 300 delivery packages and trojanized GitHub repositories to target developers, gamers, and other users. Its analysis found a two-part LuaJIT payload designed to evade file-by-file sandboxing, capture screenshots, and support credential theft through attacker-controlled infrastructure.
Netskope Threat Labs disclosed on March 23 a malware operation it calls TroyDen's Lure Factory, linking more than 300 delivery packages to a common LuaJIT-based toolchain. A counterfeit GitHub repository presented itself as a Docker deployment helper for OpenClaw, while related packages used other lures aimed at developers, gamers, cryptocurrency users, and the general public.
The original research predates the August 4 reporting that resurfaced it. This article therefore treats the event as an archive report on Netskope's March disclosure rather than a newly uncovered August campaign.
A repository built to look legitimate
Netskope said the fake OpenClaw repository copied the structure and presentation of a legitimate project, including a polished README, a companion GitHub Pages site, and contributions of functional code. The malicious download was added separately and packaged as three files: a short launcher, a renamed LuaJIT interpreter, and an obfuscated script stored as a text file.
That split matters because automated scanners often examine files individually. Netskope found that the interpreter and encrypted script revealed the malicious behavior only when executed together. The payload also ran five anti-analysis checks and invoked an extreme sleep interval intended to outlast timed sandboxes.
What the payload exposed
After researchers patched the delay and observed the full execution chain, the malware disabled Windows proxy auto-detection, queried a geolocation service, captured the desktop, and sent the screenshot to command-and-control infrastructure in Frankfurt. The server returned encrypted task and loader data for later execution.
Netskope confirmed access to Windows cryptographic functions consistent with browser-credential harvesting. It did not recover the final task payload, so the precise credentials TroyDen would have taken remain unconfirmed. The research instead links the loader architecture and infrastructure to related campaigns that delivered credential-stealing malware.
The team assessed with high confidence that three confirmed campaigns shared an operator, based on identical binaries, a shared Lua codebase, and common infrastructure. It reported the identified GitHub repositories to GitHub on March 20 and published hashes, network indicators, and detection material with the March 23 report.
Why it matters for developer security
The case shows how attackers can borrow legitimate repository structure and social proof while hiding the payload in a separate download path. For platform and security teams, the defensible response is to verify repository ownership and release provenance, inspect archives as an execution chain rather than isolated files, and alert on renamed interpreters paired with opaque data files.
The available evidence supports a broad credential-theft risk, but it does not justify combining TroyDen with separate InstallFix and SEO-poisoning campaigns or attributing all fake-AI-tool incidents to one operator.
Key Points
- 1Netskope linked more than 300 delivery packages to TroyDen's lure factory and confirmed three campaigns using the same LuaJIT toolchain and infrastructure.
- 2The payload split a renamed interpreter from an obfuscated script, frustrating file-by-file analysis before anti-analysis checks and an extreme sleep delay.
- 3Netskope observed screenshot exfiltration and credential-theft behavior but did not recover the final task payload, so the exact stolen-secret scope remains unconfirmed.
Scoring Rationale
The campaign abuses trusted GitHub presentation and evades common sandbox workflows, creating material developer and supply-chain risk. Its technical evidence is strong and operationally useful, while the March disclosure date and unconfirmed final payload limit claims of a new August incident.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
