Trading-Bot Pages with Hidden Download Links
A 15-account repository farm, static redirect decoding and scanner cloaking; the final payload is unknown.
Cristian Chiriac
- Published:
- 2 November 2026
- Version:
- 1.0
- Last observed:
- 30 October 2026
- Dataset frozen:
- 1 November 2026
- Collection cut-off:
- 31 October 2026, 17:59 UTC
- Tracked items rechecked:
- 1 November 2026, 18:23 UTC
- Time zone
- All dates UTC.
Contents
Trading-tool landing pages assemble a hidden download destination and withhold it from scanners.
The research in 30 seconds
- What I found
- Trading-tool landing pages assemble a hidden download destination and withhold it from scanners.
- What this adds
- The reviewed analysis records a 15-account farm, the decoded destination and user-agent cloaking logic.
- Verified scope
- 2,439 repositories owned by the 15 accounts; 48 pages decoded in the retained sample.
- What remains unknown
- At most 45 decoded pages belonged to the farm. The payload was never retrieved, so the whole farm is not proven malware.
The numbers, with their boundaries
Context · separate measure
2,439
Repositories on the farm accounts
29 Oct 2026 · UTC
- Counts:
- Total public repositories across 15 accounts; not 2,439 independently decoded pages.
Context · separate measure
48
Decoded pages in retained sample
By 29 Oct 2026 · UTC
- Counts:
- The sample included three unrelated pages: at most 45 were farm pages.
Earlier snapshot or subset
1,447
Search-matched farm repositories
11 May–6 Jul 2026 · UTC
- Counts:
- Keyword-matched subset; different from the 2,439 account-wide total.
Fifteen GitHub accounts hold 2,439 public repositories that look like crypto trading tools: "sniper
bots", "volume bots", MEV and Polymarket bots. Each repository contains only a licence, a .gitignore and
an index.html published with GitHub Pages. The page builds a hidden download address on
githubsecuredownload[.]online and refuses to do so for crawlers and scanners.
- The redirect and the cloaking are proven from the page code, decoded statically in a sample of 48 pages.
- The downloaded file was never retrieved, so what it installs is unknown. The domain had 0 of 92 detections on VirusTotal.
- All 15 accounts were live on 29 October 2026.
I did not open any page in a browser, visit the domain or download anything.
Where this stands (1 November 2026)
#The proven set was closed on 1 November 2026 with what had been found up to 31 October 2026, 17:59 UTC; repositories found after that are tracked separately and are not in these figures. The full proof pass at pinned commits ran on 30–31 October. On 1 November 2026, 18:23 UTC a read-only GitHub API recheck covered the 162 repositories, 73 accounts and 12 issues that are tracked one by one (operator repositories, Shai-Hulud accounts, phishing issues), not the whole set.
- Not counted: 15 accounts with 2,439 repositories, unchanged on 1 November; the download was never retrieved.
Key findings
#Scope and method
#Expand technical detail · complete record
| Step | What was done | Scope | Date (UTC) | Coverage limit |
|---|---|---|---|---|
| 1. Search | Crypto-bot lure keywords: sniper bot, drainer, MEV bot, volume bot, wallet recovery, pump.fun bot, airdrop claim | 5,376 repositories | to 29 Oct 2026 | Keyword matches only |
| 2. Clustering | Owners with hundreds of near-identical repositories | 15 accounts | 29 Oct 2026 | — |
| 3. Structure | File tree of each repository | Sampled | 29 Oct 2026 | — |
| 4. Static decode | index.html scripts decoded without a browser, in an isolated VM |
48 pages | before 29 Oct 2026 | Hit rate across all pages not recorded |
| 5. Domain | Registration and reputation; no visit | 1 domain | before 29 Oct 2026 | Hosting hidden behind Cloudflare |
| 6. State | Accounts and public repository counts | 15 accounts | 29 Oct 2026, 07:43 | Single check |
At a glance
#| Count | Value | What it counts |
|---|---|---|
| Accounts | 15 | Random-word names; all live at 07:43 UTC on 29 Oct |
| Public repositories on those accounts | 2,439 | Live count on 29 Oct; per account 45–265 |
| …matched by the crypto-bot searches | 1,447 | Created 11 May – 6 July 2026: May 1,097, June 246, July 104 |
| Landing pages decoded | 48 | Static decode, sampled |
How the pages work
#- 01Bot repository found in searchT1608.005<topic>-sniper-bot-ab12 or <topic>…ot-pcwinmac-ab12; only .gitignore, LICENSE.md and index.html
- 02GitHub Pages landing pageOffers Windows and Mac downloads
- 03Address assembled at runtimeT1027base64 fragments or XOR table with key 0x2A + i % 15, so code search cannot find the domain
- 04User-agent checkNo redirect for bot, curl, python, googlebot or headless clients
- 05Look-alike download domainT1036.005githubsecuredownload[.]online/hrf/win; file not retrieved
| Element | Observed |
|---|---|
| Topics in names | pump.fun, Birdeye, Uniswap, OpenSea, Blur, GeckoTerminal, Polymarket, sandwich attacks, low-cap gems, NFT wash trading, DEX liquidity |
| Repository content | .gitignore, LICENSE.md, index.html; no source code |
| Code comments | Russian (a language observation, not attribution) |
| Domain | githubsecuredownload[.]online, registered 22 April 2026 through Global Domain Group LLC, Cloudflare name servers, VirusTotal 0/92 |
A Roblox lure site from another campaign, rbxhub[.]best, was registered eleven days earlier through the
same registrar. A shared registrar alone is weak evidence.
ATT&CK mapping
#Expand technical detail · complete record
| Technique | Name | Tactic | Evidence |
|---|---|---|---|
| T1608.005 | Link Target | Resource Development | Landing pages hosted on GitHub Pages that lead to a download (observed) |
| T1027 | Obfuscated Files or Information | Stealth | Download address split into base64 fragments or an XOR table (observed) |
| T1036.005 | Match Legitimate Resource Name or Location | Stealth | Download domain imitating GitHub (observed) |
Evidence register
#Expand technical detail · complete record
48 sampled index.html scripts decoded without execution; destination address, encoding scheme and user-agent deny list recorded.
Source: GitHub contents API inside an isolated VM · Collected 29 October 2026
Fifteen accounts with their public repository counts, structure and creation dates of the 1,447 search-matched repositories.
Source: GitHub repository search and user metadata · Collected 29 October 2026
Confidence and alternative explanations
#| Inference | Confidence | Alternative explanation | Why it is less likely |
|---|---|---|---|
| The download is malicious | Moderate (unverified) | An aggressive but harmless adware or affiliate download | Cloaking, a GitHub look-alike domain and source-free "bots" serve no legitimate purpose |
| All 2,439 repositories carry the redirect | Moderate | Only part of the farm does | Identical structure; only 48 decoded |
| Related to Arctic Wolf's "GitHub Download" servers [1] | Unknown | Independent operator | Their IOC list was not checked |
Timeline
#Earliest farm account created
githubsecuredownload[.]online registered
First search-matched farm repository
22:35 UTC
Last search-matched farm repository
23:17 UTC
15 accounts and 2,439 repositories live
Data notes and reconciliation
#Expand technical detail · complete record
| Item | Values seen | Explanation |
|---|---|---|
| Farm repositories | 1,447 vs 2,439 | Search-matched repositories versus all public repositories on the accounts |
| Decoded sample | 48 pages | The sample list also contained 3 pages of an unrelated account, so at most 45 farm pages |
| Per-account counts | Three different sets | Earlier notes, search corpus and live count; the live count is used |
Defensive checks
#- A trading bot without source code is a landing page, not software. Treat GitHub Pages download buttons for bots as untrusted.
- Domain reputation is not enough: this one had no detections. Block look-alike "github…download"
domains that are not
github.comorgithubusercontent.com. - Automated scanning will miss it, because the page cloaks on user agent. Decode the script statically.
- Report the accounts, not the repositories: 15 accounts hold all 2,439.
Indicators
#Expand technical detail · complete record
| Type | Value | Context | Copy | |
|---|---|---|---|---|
| url | hxxps://githubsecuredownload[.]online/hrf/win | Decoded download address (Mac variants exist); not visited Confidence: High-confidence suspicious | ||
| domain | githubsecuredownload[.]online | Registered 22 Apr 2026; VirusTotal 0/92 Confidence: High-confidence suspicious |
Repository structure: exactly .gitignore, LICENSE.md and index.html with GitHub Pages enabled. Name
patterns: <topic>-sniper-bot-[a-z]{2}[0-9]{2} and <topic>…ot-pcwinmac-[a-z]{2}[0-9]{2}. Script traits:
atob fragments or an XOR table with key 0x2A + i % 15, and a user-agent deny list including bot, curl,
python, googlebot and headless.
| Type | Value | Context | Copy | |
|---|---|---|---|---|
| other | Hexagonclochateau | GitHub user created 2026-03-27, live on 2 November 2026. Farm account: 244 public repos (GitHub Pages index.html redirects to githubsecuredownload[.]online) Confidence: High-confidence suspicious | ||
| other | surfacefencercanal | GitHub user created 2026-04-25, live on 2 November 2026. Farm account: 232 public repos (GitHub Pages index.html redirects to githubsecuredownload[.]online) Confidence: High-confidence suspicious | ||
| other | Twilightfobeam | GitHub user created 2026-03-27, live on 2 November 2026. Farm account: 209 public repos (GitHub Pages index.html redirects to githubsecuredownload[.]online) Confidence: High-confidence suspicious | ||
| other | NeedleBricklayer | GitHub user created 2026-04-25, live on 2 November 2026. Farm account: 210 public repos (GitHub Pages index.html redirects to githubsecuredownload[.]online) Confidence: High-confidence suspicious | ||
| other | EastCanaryChisel | GitHub user created 2026-04-25, live on 2 November 2026. Farm account: 190 public repos (GitHub Pages index.html redirects to githubsecuredownload[.]online) Confidence: High-confidence suspicious | ||
| other | sentinelmacawvoid | GitHub user created 2026-04-25, live on 2 November 2026. Farm account: 155 public repos (GitHub Pages index.html redirects to githubsecuredownload[.]online) Confidence: High-confidence suspicious | ||
| other | selffiscalscheme | GitHub user created 2026-03-27, live on 2 November 2026. Farm account: 207 public repos (GitHub Pages index.html redirects to githubsecuredownload[.]online) Confidence: High-confidence suspicious | ||
| other | Radiancenopray | GitHub user created 2026-04-30, live on 2 November 2026. Farm account: 85 public repos (GitHub Pages index.html redirects to githubsecuredownload[.]online) Confidence: High-confidence suspicious | ||
| other | MomentumTermite | GitHub user created 2026-06-12, live on 2 November 2026. Farm account: 85 public repos (GitHub Pages index.html redirects to githubsecuredownload[.]online) Confidence: High-confidence suspicious | ||
| other | silentcabinpyre | GitHub user created 2026-06-21, live on 2 November 2026. Farm account: 85 public repos (GitHub Pages index.html redirects to githubsecuredownload[.]online) Confidence: High-confidence suspicious | ||
| other | scalarsupporterplay | GitHub user created 2026-06-14, live on 2 November 2026. Farm account: 85 public repos (GitHub Pages index.html redirects to githubsecuredownload[.]online) Confidence: High-confidence suspicious | ||
| other | Glowgludream14 | GitHub user created 2026-04-25, live on 2 November 2026. Farm account: 111 public repos (GitHub Pages index.html redirects to githubsecuredownload[.]online) Confidence: High-confidence suspicious | ||
| other | Uploadtadefine | GitHub user created 2026-06-14, live on 2 November 2026. Farm account: 45 public repos (GitHub Pages index.html redirects to githubsecuredownload[.]online) Confidence: High-confidence suspicious | ||
| other | BaseVendorAdapt | GitHub user created 2026-04-27, live on 2 November 2026. Farm account: 265 public repos (GitHub Pages index.html redirects to githubsecuredownload[.]online) Confidence: High-confidence suspicious | ||
| other | plotmailmanbang | GitHub user created 2026-04-25, live on 2 November 2026. Farm account: 231 public repos (GitHub Pages index.html redirects to githubsecuredownload[.]online) Confidence: High-confidence suspicious |
What was already public
#Expand technical detail · complete record
Sources were read on or before 29 October 2026. Each one also links to its Internet Archive record, which lists the captures that exist, in case the original moves or changes.
- Arctic Wolf, fake GitHub repositories with "secure download" GitHub Pages landing pages delivering BoryptGrab (July 2026): https://arcticwolf.com/resources/blog/fake-github-repositories-deliver-boryptgrab-lineage-infostealer/ (Internet Archive lookup) It mentions six "GitHub Download" servers it does not name; this domain could be one of them.
- BleepingComputer on the same research (14 July 2026): https://bleepingcomputer.com/news/security/nearly-300-github-repos-pose-as-legit-software-to-push-malware (Internet Archive lookup)
- Check Point Research, sniper-bot lures with fake reputation delivering a clipboard hijacker (17 June 2026): https://research.checkpoint.com/2026/from-stars-to-upvotes-fake-reputation-fueling-a-crypto-clipboard-hijacker/ (Internet Archive lookup)
- Kaspersky GitVenom, fake bot and tool repositories (February 2025), via The Hacker News: https://thehackernews.com/2025/02/gitvenom-malware-steals-456k-in-bitcoin.html (Internet Archive lookup)
Not found in the reports I read, as of 29 October 2026: this domain, the 15-account farm, its naming and its cloaking script.
Limitations
#- The payload was never retrieved, by design (no contact with attacker hosts). Its family and effect are unknown.
- Only 48 pages were decoded, by another analysis session whose notes I rely on.
- GitHub Pages visit numbers are unknown.
- Domain data come from an earlier lookup and were not re-checked.
Investigation context
#This article is part of the GitHub threat investigation. Counts are a snapshot, not evidence that the code ran on a victim's machine. The shared methodology and proof rules explain inclusion, exclusions and the independent re-check.
Claims, evidence and limits
| Claim | Assessment | Evidence | Limit |
|---|---|---|---|
| Landing pages with a hidden, cloaked redirect | Confidence: Confirmed malicious | E-CF-DECODE | Not stated in the finding |
| Fifteen accounts, 2,439 repositories | Confidence: High-confidence suspicious | E-CF-ACCOUNTS | Not stated in the finding |
| The final payload is unknown | Confidence: Unconfirmed | E-CF-DECODE | Not stated in the finding |
Terms used on this page
- pinned commit
- A specific commit, identified by its hash, at which a repository was read. Every counted repository was proven at the default-branch commit recorded in the proof pass, so a later change to the repository does not change what was proven.
- proof pass
- The 30–31 October 2026 re-read of every candidate at a pinned commit under fixed inclusion rules, followed by an independent re-read of a random sample of 555 repositories through a different API.
All terms: glossary.
Corrections & discussion
Found an error, or have evidence that supports or contradicts a finding? Send a correction. Name the section and what you observed.